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(57) ABSTRACT 

An impact analysis software system is described which 
resides on a computer connected to a network in an enter- 
prise. The system analyzes the impact of network events on 
the network, and includes a number of modules, including a 
number of data source adapters for interfacing with external 
data sources to thereby allow access by the system to 
enterprise-related data in the external data sources. The 
system further includes an impact analysis data structure 
populated with data accessed from the external data sources 
and defining relationships between the enterprise -related 
data. One or more action tree data structures comprise a 
routine which, when executed, acts upon the relationships 
defined by the impact analysis data structure to handle 
events. A message processor reads the network events and 
select one of the action tree data structures to handle each 
read network event. 
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METHOD AND SYSTEM FOR NETWORK It is another object of the present invention to allow 

EVENT IMPACT ANALYSIS AND network administrators to quickly and correctly determine 

CORRELATION WITH NETWORK what users and business processes are impacted by incoming 

ADMINISTRATORS, MANAGEMENT faults so as to minimize the impact to critical business 

POLICIES AND PROCEDURES 5 processes. 

It is another object of the present invention to allow 

COPYRIGHT NOTICE administrators to determine how work should be prioritized 

a c *i_ j* i » . ■ • , .j and responsibility assigned for incoming faults. 

A portion of the disclosure of this patent document . . , .... . . 

contains material which is subject to copyright protection. 10 } X 15 a *°! her **** the present invention to determine 

The copyright owner has no objection to the facsimile what pohcies should be foUowed when resolving faults, 

reproduction by anyone of the patent document or the patent li 18 another object of the present invention to raise 

disclosure, as it appears in the Patent and Trademark Office network service levels by reducing mean time to service 

patent files or records, but otherwise reserves all copyright restoration by automating escalation and response proce- 

rights whatsoever. 15 dures. 

BACKGROUND OF THE INVENTION li * aDOthcr ° bjcCt ° f prCSCDt mvcation lo cnable 

BACKGROUND Ob JHE INVENTION organizations to leverage vital information scattered across 

The invention relates to computer and telecommunication disparate databases without going through a difficult process 

network monitoring and management and, more of co-locating databases or re-keying data into a common 

particularly, to methods and systems for correlating col- format. 

lected event data with administrators, management policies 20 [ t is another object of the present invention to enhance IT 

and procedures. flexibility by allowing data to remain decentralized yet 

When most end users think about information technology accessible from a central control point. 

(IT), they are more concerned with reliability and speed of The above and other objects are achieved by an impact 

the business critical services that IT delivers than the grow- analysis software system residing on a computer connected 

ing infrastructure that supports those services. Meanwhile, to a network in an enterprise. The system analyzes the 

reliance on an ever-widening web of network, system, impact of network events on the network, and includes a 

database and application resources makes these services number of modules, including a number of data source 

even harder to manage. adapters for interfacing with external data sources to thereby 

With this critical reliance on the network, and the services 30 allow access by the system to enterprise-related data in the 

provided, it is essential to pinpoint the probable cause of real external data sources. The system further includes an impact 

or potential service delivery problems and resolve them analysis data structure populated with data accessed from 

quickly. To do this, administrators must first understand the the external data sources and defining relationships between 

entire infrastructure, the IT resources that support it, and the enterprise -related data. One or more action tree data 

how they work together to deliver services. Incoming events 35 structures comprise a routine which, when executed, acts 

must be continuously sifted through to detect those affecting upon the relationships defined by the impact analysis data 

an enterprises ability to sustain service levels. structure to handle events. A message processor reads the 

Improving service levels while reducing costs is every IT network events and select one of the action tree data 

manager's goal, whether the service is being provided to an structures to handle each read network event, 

external subscriber or an internal end user within a corporate In some embodiments, the external data sources store data 

enterprise. The key to realizing these goals is optimizing using a plurality of different formats, and the data source 

processes and ensuring that policies are well planned and adapters comprise a data source adapter corresponding to 

enforced. each data source format. The system includes a selection 

In many organizations, the process of handling network routine for selecting one of the data source adapter corre- 
and system faults is much less than one hundred percent 45 sponding to a given external data source, 
efficient. Often, tangible economic benefits can be realized As a result, the system and corresponding process lever- 
by simply automating the task of analyzing the impact of ages data presently stored throughout a corporate enterprise, 
network faults on services, business units and customers. The system utilizes the data source adapters to access a 
Further efficiencies can be achieved by optimizing policies plurality of third party data sources including relational 
for fault escalation and resolution. 50 databases developed by Sybase Inc. and Oracle Inc., data 

Identifying and maintaining the following information is sources accessed via the LDAP protocol, data stored in 

critical to maintaining acceptable network service levels: HTML or text format, etc. By creating and storing relation- 

1) What business processes are impacted by incoming ships among the disparate data sources, the system is able to 
faults? effectively utilize existing corporate knowledge to achieve 

2) How should work be prioritized and responsibility 55 its goals. Moreover, the data utilized need not be kept in a 
assigned for incoming faults? proprietary form nor must it be administered from a central 

3) What policies should be followed for resolving incom- site> database administrators can continue to manage 
ing faults? ^ Ie * r ^ ala wn ^ e ^ ^ simultaneously capitalized upon by the 

Network access becomes increasingly critical to the per- P resent invention to build relationships between systems, 

formance and success of organizations. There is thus a need 60 business units and users/admmistrators. 

for a system for allowing network operators to quickly In embodiments, the impact analysis data structure 

determine answers to the preceding three points. comprises a plurality of organizational nodes each represen- 
tative of an enterprise element and populated with data 

BRIEF SUMMARY OF THE INVENTION accessed by the sysUm through ^ u £ £ f the daU source 

It is an object of the present invention to solve the 65 adapters, and one or more hierarchy structures of said 

problems described above associated with existing network organizational nodes, said hierarchy structures defining rela- 

management systems. tionships of organizational nodes to one another by the data 
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contained therein, said hierarchy structures representative of Referring to FIG. 1, in one embodiment of the present 

structures and business processes of the enterprise. system, there is a strict separation of logic and data layers. 

In some embodiments, the system further comprises an Within the logic layer lies an impact server 100, which stores 

event handler to receive and queue data regarding network ob i ect databa se 102. The object database contains a 
events from an event server. When an event arrives 5 plurality of objects 104, referred to herein as Organizational 

indicating, for example, that a router port is down, the ^odes or OrgNodes, which are used to define the organiza- 

system will determine the business unit associated with this ^ st ™ cture of « ™toipnse, f ch as ^ communica- 

port. It can then locate a list of people responsible for the U ° n ^f*' ^documents, etc., as well as the configu- 

r . ... ... • u • hi i ration mformation for the impact server itself. The impact 

router, scan the ^ scrver 1Q() £ u cn ^ ne 1Q6 ^ {q 

the current date and notify the party by e-mail, paging or io tmMU ^ oQ ^ w the relationships exposed by 

other suitable method. If no response is received, the system organizational structure can be used to execute complex 
automatically notifies the administrator's manager or the ia ^ ss in responS e to received events. The impact server 100 
next person listed in the business unit's chain of command. jg controlled and administered by an administrator through 
Once the event is resolved, the system will halt the escala- a command interface 122. These components are included in 
tion. 15 wnat is referred to herein as the logic layer. 

Policies can be defined by associating documents of any The functionality provided by the impact server is sepa- 
type, e.g. text or HTML, with a particular component or a rate from the data layer. The data layer is comprised of the 
person who is responsible for resolving the problem encoun- digital knowledge contained within an enterprise and the 
tered. Administrators can also examine policies related to relationships within that knowledge. The data layer includes 
specific events by simply selecting an event and requesting 20 a number of data sources 108 having different formats or 
that the system send all documentation, users, and any other lv P es and a xi °* data source adapters 110, each of which 
information associated with a particular event or class of corresponds to one of the data source formats or types, 
events. Typically, organizations are divided into departments, with 

each department managing databases containing informa- 
BRIEF DESCRIPTION OF THE DRAWINGS 25 tion regarding the department. Such information may 

The invention is illustrated in the figures of the accom- * clude a dalabase containing all the nodes in the 
panying drawings which are meant to be exemplary and not department, the user name for each node and the date the 
limiting, in which like references are intended to refer to like "° de was last ba ^ d U P' Another data source 108 within the 
or corresponding parts, and in which: department might be an LDAP directory server containing 

x~t + . t_i i c , r 30 the names, e-mail addresses and pager numbers of each user 

FIG. 1 is a block diagram of an exemplary system for . , , . « . , . 5 °, , . , . 

... > c * j j in the department. This data can then be exposed to the logic 

assessing the impact of events and admmistenng policies to k b / normalizin ^ data ^ugh the use of the data 
achieve solutions in accordance with one embodiment of the J j ♦ im 
resent invention* source adapters 110. 

„, _ , ~ The data source adapters 110 are software interfaces that 

FIG. 2 is a flow chart showing an exemplary process of Js are ^ tQ access ^ e relationships between a 
generating ^anizaUonal nodes stored and used in the ^ of data SQWces m such as; relatk)nal databases 
system of FIG. 1 m accordance with one embodiment of the developed by Sybase toc and Qracle Inc ; data „„, 
present mvention, accessible via the LDAP protocol, data stored in HTML or 

FIGS. 3 and 4 are flow diagrams showing exemplary ASCII text format, etc. Using the data source adapters 110, 
conversions of data from a data source to an organizational 40 lhc mana g er 0 f the impact server 100 need not learn any of 
node in accordance with one embodiment of the present the mu iti p le query formats needed to access these different 
invention; databases 108. Essentially, the data source adapters 110 

FIG. 5 is a diagram of a hierarchy structure of organiza- render these data source differences invisible to the admin- 
tional nodes in accordance with one embodiment of the istrator and the system by handling the different methods 
present invention; 45 needed to access the data and returning the data in a format 

FIG. 6 is a flow chart showing a process of generating understandable by the server, 
relationship between organizational nodes in accordance Administrators need only input information to the impact 
with one embodiment of the present invention; server 100 which indicates where a particular data source 

FIG. 7 is a diagram of a linking relationship between two 108 resides to expose the data contained in its tables. The 
organizational nodes in accordance with one embodiment of 50 impact server 100 then selects the appropriate data source 
the present invention; adapter 110 which corresponds to the indicated data source 

FIG. 8 is a diagram showing relationships among a 108, and the selected data source adapter handles the trans- 
number of organizational nodes in various hierarchy struc- lation of the request and returns the data in a format usable 
tures in accordance with one embodiment of the present by the impact server 100, thereby normalizing the data, 
invention; 55 Moreover, by allowing the data to be exposed without the 

FIG. 9 is a flow chart showing an exemplary process of need to administer each data source, the administrator is 
propagating impact decisions among a organizational node relieved of the burden of managing multiple data sources or 
hierarchy in accordance with one embodiment of the present having to rekey multiple data sources into a format under- 
invention; and standable by the impact server. This structure allows the 

FIGS. 10-15 show exemplary screen displays generated 60 distributed maintenance of the system so that each manager 
by a software system implementing one embodiment of the " onl y responsible for managing the data sources in his or 
present invention. ner area » thereby easily accessing and leveraging the knowl- 

edge contained in these distributed data sources. It is this 

^^U^^ZS^ CXp0SCd daU Md itS tont Unships that are used to 

rKfcrbRKLD EMBODIMENTS 65 generate the information contained in the OrgNodes 104, 

Preferred embodiments of the invention are now which are the objects that are used to model the organiza- 

described with reference to the drawings in the Figures. tional structure of the enterprise. 
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As stated above, OrgNodes 104 are objects used to model in the node OrgNode 706. The ability to place OigNodes in 

relationships that represent the organizational structure of hierarchical trees and link them provides a description of the 

the enterprise. The OrgNodes 104 can represent business business processes for a particular site. Linking various 

units within the enterprise, network devices, applications, objects in the trees provides an infrastructure that allows the 

services, customers, users, and other relevant entities. For 5 system to perform complex queries on the data objects, 

example, an object representing a node within a business Specialized OrgNodes, known as a Rota, can be created to 

department might be related to a group of user objects. represent the concept of a scheduled rotation. Any type of 

Referring to FIG. 2, a system user first creates a new OrgNode can be used in a Rota, allowing a system operator 

OrgNode that contains no data, step 202. The user next to ^ Rolas to have a different user selected based on the 

selects the data source from which data will be extracted, 10 time of day an event is received, as well as different 

thereby populating the OrgNode with data, step 204. If the documents or severities. For example, certain people may be 

data source is divided into multiple parts, e.g., tables, the responsible for a database service at different times of the 

user may further specify the specific pieces of data to pull day. In this case, a Rota of administrators would select the 

from the data source, step 206. The system then utilizes the specific user on call at a particular time. Another example is 

appropnate data source adapter 110 which queries the data 15 a R Q ta of event severity. Some events may be regarded as 

source and returns a result set, step 208. Data returned from extremely urgent during the weekdays but not as urgent at 

the data source adapter is then used to populate the OrgNode mg ht or during the weekends. A Rota of event severity could 

with data, step 210. adjust the severity of an event based on the time of day by 

OrgNodes 104 act in concert with the enterprise data querying data source that contains a time/severity matrix, 

exposed by the impact server through the use of the data 20 [ n one embodiment, the process of populating OrgNodes 

source adapters 110. Referring to FIG. 3, an MIS department an d identifying relationships between OrgNodes is per- 

might have an LDAP directory 108 containing the names formed on the fly, dynamically, as the OrgNodes are needed 

and e-mail addresses of all administrators in the department. f or processing by action trees, as described further below. A 

An administrator wishing to create OrgNodes representing hierarchy structure of OrgNodes as described above is 

each administrator can transparently expose the data con- 25 maintained in the impact server 100, and data is retrieved for 

tained in the LDAP directory by the functionality provided me OrgNodes from data sources 108 using the respective 

by the data source adapters 110. This data is then used to data source adapters 110 as the OrgNodes are referenced in 

create objects representing individual administrators 104, an action tree or policy which is executing. The data source 

each object containing the administrator's name and e-mail adapters then retrieve data from the data sources to populate 

address (or any other data exposed by the data source). 30 the 0rg Nodes. In this way, up-to-date information may be 

Similarly, referring to FIG. 4, a department might have a obtained from the data sources, 

database 108 containing all the nodes in a business unit and i n addition, the data source adapters search for and 

the name of the administrator responsible for each node. retrieve relationship data from the data sources to use in the 

Odcc again, using a data source adapter 110, the data process of establishing relationships between OrgNodes. 

contained in this data source can be used to populate objects The data source adapters search for specific fields in each 

representing all the nodes in a business unit . 104. In this data type which may contain data which is used in estab- 

manner, administrators can define lists of users and hierar- fishing relationships. For example, a data source adapter 

chies of business units, linking users to their respective retrieving data about a workstation or node searches for an 

business units. administrator identifier field in the data source, and, if one is 

There are many types of relationships between OrgNodes, found, retrieves the information contained therein. This data 

for example, a child/parent relationship. Children allow is then used by the impact server to identify one or more 

OrgNodes to be arranged in a hierarchical manner, suitable administrator OrgNodes and automatically establish links 

for bubbling up through business departments or locations. between the two OrgNodes. If such data is missing from the 

These hierarchies of objects are stored in the object database 45 data sources, a user may input it directly into the impact 

102. For example, referring to FIG. 5, a corporation 502 may server, as described above. As a result, users wishing to 

be composed of multiple sales units 504. Each sales unit 504 make changes to the organizational scheme need only 

may contain any number of workstations or other IT infra- update the data in the data sources, and this updated data is 

structure objects 506. Similarly, an organization may contain automatically and dynamically captured by the impact 

a supervisor 508. The supervisor 508, in turn, can be in 5Q server using the data source adapters, 

charge of any number of administrators 510. jh e relationships created between OrgNodes may be 

Links allow for the arbitrary association of OrgNodes of viewed graphically by the impact server administrator, 

different types. Referring to FIG. 6, a system user first Referring to FIG. 8, a business unit in an enterprise 802 may 

selects an OrgNode to create a link from, step 602. The user be linked to all of the workstations 804 contained in the 

will select a data field or fields from which to create the link, 5S business unit. Relationships between workstations and 

step 604. The user next specifies the data fields from the administrators 806 will also be exposed. Furthermore, rela- 

OrgNodes that the current OrgNode will link to, step 606. tionships between a business unit's supervisor 808 and any 

The system will then query all OrgNodes in the system and documentation 810 regarding the unit's operational policies 

create a link between OrgNodes wherever the specified will also become apparent. 

relationship exists, step 608. If the user requires additional 60 Referring again to FIG. 1, events 112 are collected by 

links to be created between OrgNodes, the process is from any number of commercially available event servers, 

repeated, step 610, else the process of creating links is The system is connected to the event server's database by 

terminated, step 612. wav 0 f a n event feed. This connection is used by the impact 

For instance, referring to FIG. 7, an administrator server's event broker 114 to poll the event database for new 

OrgNode 702 may be linked to a workstation OrgNode 704 65 events. The event broker 114 is a module that provides for 

in all places where the name contained in the administrator real time event processing. As new events are read, they are 

OrgNode matches the name of the administrator contained placed into a buffer and read one at a time. 
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All incoming messages are place in a queue to be acted to reflect the resolution and passed back to the event server, 

upon by a message processor 116, which is another com- step 918. If the supervisor fails to respond, this escalation 

ponent of the impact server 100. For each message read from process will continue until the event is resolved, step 920. 

the queue, the message processor 116 executes the proper Returning to step 906, if no administrator is contained in 

action tree on the event contained within the message. The 5 the OrgNode representing the object broadcasting the event, 

type of event determines what should be done with the me tree will look up the OrgNode representing address 

incoming event, e.g., an incoming e-mail and a fault noti- 219.119.911.82 and follow the link to the OrgNode repre- 

fication are both incoming events, but different processes are senting the business unit's supervisor and return his or her 

performed on them. The message processor 116 then spawns contact information, e.g., pager number, step 922. As above, 

the appropriate action tree, described in greater detail below. 10 me message will be parsed from the event and sent to the 

Multiple message processors 116 and 118 can be utilized supervisor as a message, at which point the Action Tree will 

in one embodiment of the invention, with each running in its go into hibernation, step 924. If the supervisor responds that 

own thread. Alternatively, each message processor 116 and the event has been resolved, the Action Tree reawakens, the 

118 can run on a different machine, simultaneously process- event is modified to reflect the resolution and passed back to 

ing events. Since each message processor 116 and 118 opens 15 the Event Server, step 926. If the event is not resolved, i.e., 

its own connection to the event broker 114, it does not the wake up period has lapsed, the Action Tree can escalate 

impose extra load on a single impact server. the event by following the link from the supervisor's 

The processes of impact analysis, response and prioriti- OrgNode to the OrgNode representing the next responsible 

zation and policy management are implemented by using person in the chain of authority, step 928. 

action trees. Action trees are a policy data structure for 20 In addition to utilizing data embodied by OrgNodes to 

handling events and operator requests. Action trees are handle event resolution, Action Trees call and execute 

comprised of action nodes, which are objects and a special- external scripts. Scripts can reside on any host within the 

ized type of OrgNode. Action nodes can thus be linked to enterprise and be located on the system hosting the impact 

each other and viewed since node branches are exposed as server. Because of this, scripts can be written in virtually any 

parents and children. Action nodes comprise a collection of 25 scripting language supported by the various hosts. As can be 

actions and decision branches. Action trees can precisely appreciated by one skilled in the art, this functionality gives 

mirror an organization's structure by defining intricate rela- the impact server unmatched flexibility to automate the 

tionships between business processes, employee schedules event resolution process and cure system faults with speeds 

and network infrastructure. This functionality is achieved by that were unattainable using existing systems, 

utilizing the data and relationships exposed by the data 30 Action Trees can also be utilized to auto-populate, or 

source adapters and modeled by OrgNodes. substitute, fields in received events that are otherwise 

Action trees also have the capability to return events to the incomplete. When the impact server attempts to act upon an 

event server being polled by the impact server, making the event, it will first determine whether data is missing from 

event more meaningful to the event server operator and, as 35 any field in which searches for data. If it is determined that 

a result, speeds up the process of fault resolution. An data is missing and an event is thus incomplete, the Action 

example of this might be to replace IP addresses with host Tree is used to query the appropriate data source to locate 

names or to set the severity level of the event to a particular missing information. The retrieved information is added to 

level based on the time the event occurred. complete the event. The now complete event is then sent 

A more complex action tree might go through the follow- 40 back to the event server. For example, a network service 

ing steps. Referring to FIG. 9, an event is received, step 900, provider maintains a database of how circuits map to spe- 

from the event server stating that the node at IP address cific customers. At times, events are received in which the 

219.119.911.82 has a file system that is out of free space. customer field is blank. Using the "Circuit ID" as a key field, 

The appropriate Action Tree is located by the Message me impact server can query the database, add the customer 

Processor, step 902. The Action Tree is then invoked, step 45 information field into the event, and send the complete event 

904, by executing the root Action Node in the tree. The Tree back to the event server. 

will look up the OrgNode representing address As mentioned above, another feature of the present inven- 

219.119.911.82 and follow the link to the OrgNode repre- tion is the ability to put Action Trees into a hibernation state, 

senting the node's administrator, step 906. If the OrgNode When hibernation is triggered, a process saves the state of 

representing 219.119.911.82 has administrator data, the 50 the currently executing Action Tree to a state database 120 

appropriate administrator object is then queried for needed (FIG. 1) contained within the impact server 100 and stops 

information, such as the administrator's e-mail address or execution, resulting in a sleep state or "hibernation". Data 

pager number, step 910. The system then pages the appro- saved in the database includes, but is not limited to, the 

priate administrator and goes into a hibernation state (see reason for hibernation and a reawaken time. An escalation 

below) to await the administrator's response, step 912. If the 55 service runs periodically to instruct the state database 120 to 

administrator responds that the event has been resolved, the reawaken any sleeping Action Trees whose wakeup time has 

Action Tree reawakens, the event is modified to reflect the passed, thereby resulting in processing continuing at the 

resolution and passed back to the event server, step 914. node that was executing when the Action Tree was put to 

If the event is not resolved, e.g., the wake up period has sleep, 

lapsed, the Action Tree can escalate the event by following 60 A hibernating Action Tree can also be woken up by 

the link from the administrator OrgNode to the OrgNode receiving a wakeup call message. E-mail or other messages 

representing the administrator's supervisor, step 916. This sent to the system are parsed and placed in a data structure 

object is then queried to determine the supervisor's pager to determine exactly which hibernating action tree to 

number, etc., step 916 and dispatches a messages at which awaken. This data structure also stores parsed information 

point the Action Tree goes into hibernation while awaiting a 65 regarding how to handle the next step in the Action Tree, 

response. If the supervisor responds that the event has been allowing the Action Tree being woken up to branch based on 

resolved, the Action Tree reawakens, the event is modified data from the received message. Atypical application of this 



07/21/2004, EAST Version: 1.4.1 



US 6,694362 Bl 



10 



ability would be to parse the e-mail received and acknowl- 
edge the event resolution if the user replied "OK" or to 
escalate the event if the user replied "ESCALATE". 

Using the ability to return modified events to the event 
server, thereby updating information contained in the event 
database, and Hibernate to save state, very powerful work- 
flow or problem management applications can be built that 
are tightly integrated with the event server. 

According to the above description, the present invention 
enables service providers to improve service levels while 
reducing costs by automating the process of impact analysis, 
event escalation and fault resolution. The process is opti- 
mized by building a bridge between real time network 
fault/event feeds and relevant information stored throughout 
the organization. This is accomplished by linking different 
data sources to define relationships and enforce policies, 
thereby separating data from the processes to be performed 
upon it and freeing the administrator from the complex and 
time consuming task of managing a potentially tremendous 
variety of data stores to expand on the generated event data. 

FIGS. 10-15 are screen displays generated by one 
embodiment of the invention and displayed on the command 
interface 122 (FIG. 1) to the impact server 100. In the 
display shown in FIG. 10, an administrator is presented with 
four types of functional modules— configuration, policy 
editor, type editor and operator view. A screen display from 
the configuration function is shown in FIG. 11. This display 
shows an organizational hierarchy structure with OrgNodcs 
for administrators (e.g., PAT RICE, DEVELOPMENT 
HEAD, THEBES ADMIN), business units or departments 
(e.g., DEV, SALES), nodes or workstations (e.g., SUMPY, 
ABULAFIA), action nodes (e.g., CONTACT VIA EMAIL, 
HIBERNATE AFTER CONTACTING USER), and other 
OrgNodes. The OrgNodes are visually arranged showing 
their relationships, with, for example, business departments 
shown linked to administrators and workstations, and 
administrators linked to action nodes which contain pro- 
cesses for implementing policies for contact the administra- 
tors. Action nodes are linked to form action trees. Users can 
interact with this screen display to edit the OrgNodes 
relationships. 

Action tree and node objects and accompanying policies 
are edited through the exemplary screen display shown in 
FIG. 12. The ACTION NODES IN TREE dialog in the 
display shows the various action nodes contained within the 
tree CONTACT VIA EMAIL and their hierarchical relation- 
ship. The ACTION NODE EDITOR dialog allows the user 
to input and modify aspects of the nodes, including the 
variables and functions in the node. 

Users can input and modify data types through the exem- 
plary screen displays shown in FIGS. 13-14. FIG. 13 shows 
a dialog for editing parameters of a node from which data is 
retrieved and FIG. 14 shows a dialog for editing parameters 
of an administrator data type. 

Finally, FIG. 15 shows an exemplary screen display for 
allowing a network operator to view the status of various 
network events. The events are listed in a grid, which 
includes a field called "Summary" for displaying the nature 
of the event. An operator view dialog shows data from the 
administrator OrgNode(s) linked to the node affected by 
each event, and the data in that OrgNode as retrieved from 
a data source using a data source adapter, as described 
herein. 

While the invention has been described and illustrated in 
connection with preferred embodiments, many variations 
and modifications as will be evident to those skilled in this 
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art may be made without departing from the spirit and scope 
of the invention, and the invention is thus not to be limited 
to the precise details of methodology or construction set 
forth above as such variations and modification are intended 
to be included within the scope of the invention. 

The following Appendix contains a listing of classes and 
an exemplary language which can be used to implement one 
embodiment of an impact server and supporting services as 
described above. Reference in the Appendix to "Response" 
refer to an embodiment of the impact server as described 
herein. 

APPENDIX 

Response Data 

There are three main types of data storage in Response. 

a) System configuration this pertains to which services, 
actions and types are available and configured. The 
service manager maintains a repository of services that 
have been installed as well as which ones should be 
started automatically when the system is started. 
Currently, this data is only stored in the ODI Object 
database, although configuration for each service is 
stored in ASCII property files. 

b) OrgNodes OrgNode data consists of all the static data 
that is accessed by Response as it is performing its 
processing. Strictly speaking, OrgNodes aren't really 
static, as they may be updated by other servers or 
services as Response is running, but I refer to them as 
static data in contrast with state data, which is con- 
stantly being changed as a matter of course. Examples 
of OrgNode data are the Administrators that may be 
contacted, the business department hierarchy, lists of 
nodes and documentation. links between these objects 
are also considered to be OrgNode data. Action Trees 
are also currently stored in ODI. OrgNode data may 
reside in any database as will be discussed in the 
section regarding OrgNodes and Types. However, at 
the highest level, there is a root from which all 
OrgNode data can be navigated to. This root is stored 
in ODI. Although all OrgNode data could be stored in 
external databases, there are some types that are par- 
ticularly well suited for storage in an Object Database 
such as ODI. An example of such an object is a Rota, 
which has three levels of containment, and would 
therefore take more effort to store in a relational data- 
base. 

c) State data Data that is added and updated during the 
regular course of the execution of Response (by an 
Action Tree) is stored in a separate database file, 
although it is also an ODI database. It is kept separate 
so the state of the Response system can be reset simply 
by deleting the state database, while the static OrgNode 
data and configuration data can be left untouched. 
There may be references from the state database into 
the OrgNode database, although not vice-versa, since 
the state database may be reset at any time. 

Examples of state data are escalations in progress, which 
technically are action trees that have been saved to the 
database at a point during their life cycle. They can be 
resumed later as will be discussed in the section regarding 
Action Trees. 

Transactions/Resp Database: The db package The trans- 
action model and interfaces to ODI are abstracted into two 
classes, albeit some minor exceptions apply. db.Resp Data- 
base The RespDatabase class provides methods that proxy to 
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the ODI database. It provides services such as database simultaneously, we could replace ODI OSJI with 

openDatabase( ), startTransaction( ), endTraosaction( ), another database which supports multiple sessions and 

lookupRoot( ), and bindRoot( ). While the purpose of the remove the synchronized keyword. Whenever a discussion 

first three functions can correctly inferred from their name, of threads is made, it is assumed that any thread that needs 

the last two are specific to object databases. In an Object 5 to access the database must wait in queue for the Transac- 

Database, all objects can be navigated to from a few roots. tionManager. 

These roots are bound to names and are looked up when the TransactionManager provides the facility to register post- 
applications needs them. This abstraction was written as an commit blocks. These are TransBlocks that will be executed 
insulation from ODI's API. It has already been useful as ^ T a transaction is committed. The facility provides a way 
Response was migrated to use ODI from POET, which it 10 for data stores besides ODI to commit any changes that may 
used for the first three months of its development. have been made to objects tbey should be storing. db.Trans- 
Unfortunately, it has proven necessary to make some ODI Block The TransBlock class is similar to the Runnable 
specific method calls elsewhere in the application, although interface, in that its sole purpose is to provide a doit ( ) 
their functions are usually tweaks such as to ensure an object method in which the actual code to be executed during the 
has been fully loaded from the database before being seri- 15 transaction can be specified. To execute code atomically in 
alized. If ODI were removed, the tweaks could be removed a transaction, simply subclass TransBlock and override the 
if the new data storage layer didn't required them. db.Trans- doit ( ) method with the code to be executed. Then, make a 
actionManager TransactionManager provides all transaction sta ti c call to TransactionManager.commit( ) as such: 
control for the entire Response application. No application 
code ever explicitly beings or ends transactions. Rather, it 20 

pass instances of the TransBlock class to the ^ — 

TransactionManager, which they queues them up and TYansactionMaiiager.comimt (new TransBlock () { 

executes each one as a separate transaction. This ensures no "T^V^li^^a, A 

two threads attempt to access the database at once. j 

25 } 

ODI OSJI : 



Currently, we are using ODI's OSJI product (Object Store For more details, see the javadoc entry for the db package. 
Java Interface). OSJI is a java binding to the ObjectStore The server.Facade class has many examples of transactions, 
database, where data actually resides. OSJI, through the use ^ This will be discussed in a later section, 
of a post-compiler, adds code to persistent classes that Communications Layer— RMI was chosen as the corn- 
causes them to be automatically fetched and saved to the munications protocol since it insulates developers from 
database. This allows developers to write their application having to worry about issues such as how to marshall data 
without even taking in to account how data will be stored. across th e w j re One of the design goals of Response was to 
This means no calls are ever made to the database except for ^ applications written upon it to communicate with their 
looking up top level roots and for transactions. OSJI has GUIs and other Response subsystems running in other 
allowed us to create our class designs without being con- processes without having to design special protocols for 
strained by what maps easily to tables and columns. This has eacn sucn instance. Since it is closely integrated with java, 
allowed us to use object oriented design patterns such as the RMI makes this goal a reality as we were able to design the 
COMPOSITE pattern and multiple levels of containment ^ G tj[ to interact with subsystems in the server just as if the 
without worrying about how difficult they may be to store in sys(em was mrimiig in the same process. The same is true for 
an RDBMS model. subsystems. As will be elaborated on later, Response sub- 
Additionally, we didn't have to spend development effort systems can find each other and work together even if they 
on implementing a caching scheme, as OSJI has a C++ layer are running in separate processes or on other machines, 
which takes care of moving the necessary data between the ^ There are a few special classes that facilitate the creation 
ObjectStore server and local memory quickly, as well as 0 f ac ti vc GUIs such as the ORBPublisher/ORBSubscriber 
providing invisible caching of the data. OSJI accomplishes classes. These provide a mechanism for a response sub- 
this by marking objects that have been modified and auto- system to stream updates to a subscriber (located in a client) 
matically writing the changes to the database when the without the subsystem having to wait for the client to receive 
transaction ends. If no changes are made in a given 5Q the updates. It is done using a producer/consumer pattern in 
transaction, no database traffic is incurred and the process wn ich the subsystem sends its updates to an ORBPublisher, 
runs as if it were entirely in memory. For reading data, OSJI which places the updates in a queue. Another thread picks up 
pulls the necessary data into memory whenever a pointer is th ese updates, called Notifications and multicasts them to 
referenced. Only the instance variables of a class that are eac h of the subscribers. Since this activity takes place in 
actually referenced are paged into memory. 5S another thread, the subsystem does not stop processing if 
One shortcoming of OSJI is that it doesn't allow different problems arise when sending the updates. Additionally, 
threads in an application to have their own transactions. ORBPublisher provides us with a centralized place to iote- 
Instead, there is only one transaction for the entire grate new update schemes such as true IP based multicast 
application, which requires the application to ensure that one when them become available. Work in these areas is already 
thread won't commit the global transaction while another 60 being done by Sun in some of their distributed computing 
thread is using the database. ODFs PSE Pro does support projects such as JavaSpaces. 

multiple transactions (they refer to this as multiple Another feature of ORBPublisher Is its ability to have 

Sessions), although it doesn't have the came scalability and subscriber updates "fan-out". ORBPublisher supports a 

client/server model. multi-tiered publish/subscribe model through the use of 

To deal with OSJFs absence of support for multiple 65 proxy publishers. If multiple clients subscribe to the same 

sessions, the TransactionManager's commit ( )method is a type of updates, the service providing the updates only 

synchronized method. To allow multiple clients to access the receives one subscription request. The updates are multi- 
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casted by ORBPublisher. This is used by ORBClient and lionManager. Therefore, when designing modules that work 

OREServcr. A service running within response can register with Response, it is usually not necessary to get involved 

itself with ORB Server by calling with Transactional issues. However, this is not true for 

ORBServer.addProxyPublisher( ). The service registers services that modify the state database. These specialized 

itself with a name such as "OrgNodeUpdate Publisher". 5 applications must wrap their transactions in TransBlocks 

When a process within the client needs to subscribe to a and pass them to TransactionManager. 

service, it calls ORBClient. addSubscriber (serviceName, j ava application can use ORBClient. The GUI just 

subscriptionlnfo). ORBClient then subscribes to the sped- happens to be one application that uses it. Certain sub- 

fied service name by making a call to ORBServer. addSub- systems within the Response server use ORBClient as well 

scriber (serviceName, subscriptionlnfo). If 5 client side 10 w hen they need access to some of the high level services it 

components (for example, 5 views of the same dynamic provides. There is no RMI inefficiency incurred when this 

data) subscribe to the same service, the service will only happens as ORBClient will recognize that it is running in the 

send one update to the client's ORBClient, which will then same VM as Facade and use it directly, bypassing the 

send the 5 updates out to the 5 components in the client. ORBServer class. This is how the 3-tier architecture can 

The subscriptionlnfo field is in instance of the common- 15 collapse into 2-tier when necessary. Another use for this 

.Subscriptionlnfo class which is used to uniquely identify feature is to write auto population agents that need to insert 

which type of updates the subscriber would like to receive vast amounts of data into the system quickly. Instead of 

from the publisher service. For example, if the service was connecting as a remote process via RMI, the agent can 

"SportScoreTicker", a client may only want to receive sports instantiate the response server before ORBClient and ORB- 

score updates for the "Mets" team. Therefore, the subscriber 20 Client will know that it should directly instantiate its own 

would use the method call publisher. addSubscriber instance of Facade and use it. 

(subscriber, new Subscriptionlnfo ("SportsScoreHcker", Caching is another function performed by ORBClient. 

"Mets")). This allows subscribers to only receive the par- The retrieval of certain objects are cached within an instance 

ticular type of updates they require. It is important that the 0 f ORBClient. This cache is cleared when the possibility 

uniqueness identifier object (the "Mets" object) must always 25 exists of data being old. 

return the same basbcode and its equals ( ) method must Users md Authentication: me auth package auth .Authen- 

return true for two instances of the same uniqueness iden- b the interface m R e uses to intmct ^ m 

after In other words, instances of the umqness identifier externa , of and authentication . 

should base their equals ( ) and hashCode ( ) methods on Permissions ownels hip of objects and user preferences are 

content, and not on identity. 30 ^ ^ ^ ^ ^ ^ fey ^ A 

The SLAM service uses ORBPublisher with Subscrip- concrete instance of an Authenticator is 

tionlnfos to propagate service level changes to clients. The ObjectServerAuthenticator, which validates users and pass- 

Subscriptionlnfo's identity is based on a combination of a wor ds by attempting to login to an object Server via JDBC. 

T^^^*^^^^^™"^ 0 ^* 35 Instances of Authenticator return instances of 

SLAM GUI service level table to only receive updates that AuthUscrIfc ^ottet interface, to represent users in the 

it needs to display. See the SLAM document for more ttnderlyillg authentication system. ObjectServerAtithentica- 

lniormation. tor returns instances of ObjectServerUser. Authenticator also 

Session Layer returns groups, which are instances of classes that imple- 

40 ment Named. ObjectServerAuthenticator returns Object- 
Response is built upon a 3 tier architecture, although it ServerGroup. These references can be passed back to the 
can be collapsed into two for special applications that authenticator to get all the users in a specific group, 
require extra speed. Each client has a session created for it Additional authentication modules can be written by 
by the ResponseServer. Therefore, there is no synchroniza- implementing Authenticator and writing the corresponding 
tion required at the session layer since each client can be 45 uscr an( j g r0 up classes, 

sure it will be the only one using its session. Any synchro- . ATi . . , ~ t , „ . 

. .. . « . . ° ... . J ' , servcr.ObjectRetncver and Database Roots There are scv- 

nization is done at the lowest possible layer. For each . .... A ^ . . r . « 4 . ... 

c ^nno • ■ * . . . » « eral roots in the Object Database, from which all the static 

session, an instance of ORBServer is instantiated by , ~ \ . . 9 , 4 „ A . 

n o A nrc nk*r *t u-l. ma configuration data can be accessed. ObjectRetnever 

ResponseServer. OREServer is an RMI remote class which m • i • ♦ c c w u n a * u 

• j l ^nr»^- a aL i- a j . , provides a single point of access from which all data can be 

is accessed by ORBClient on the client side. The gui makes < n v u a tu *wv / \ _ *u a < t i u 

. ii , Annn- u- i_ . . n c 0 reached. There are getXXX () methods to lookup each root 

stauc calls to ORBClient, which contacts ResponseServer, . , . , , 6 . # v ' »■ ^ * a 

. . , . . A . . . . . A c in the database and return it. Two of the most important and 

which instantiates ORBServer and returns an instance of A c ^ , ^ * „ . / v . 

e • o r . JntvoXV , 7 . „ e LU * iauK ~ y L m0 st frequently used are ge ConfigRepository ( ) and get- 

SessionReference to ORBClient. SessionReference contains „ \ . J & & F 7 w & 

a remote reference to an ORBServer and an instance of « - „ . . . , ... 

PrefeUser, which is an instance of the User that has logged 5 , ConfigRepository is a singleton class which stores the 

in. PrefcUser will be discussed in the section about authen- configuration data for various Response subsystems. It also 

^ cat - on stores a reference to the TypeList (described below). The 

rtnn'e . . . c r a t.- u • *u getTVpeList ( ) method in ObjectRetriever proxies to Con- 

ORBServer creates an instance of Facade, which is the 2 n ■* - .t. j ^ i • . ■ 

. , . . . . c t t , r, figRepository as a convenience method, as the TVpeList is 

transaction layer and single interface to the entire Response requested very often 

system. Any application that wishes to interact with 60 

Response can accomplish what it needs to do through Types and OrgNodes 

Facade (see section on Services). dblayer package 

Facade provides a set of high level access methods into The static data in Response consists of a few sets of 

the system and takes care of transforming internal datastruc- objects. Each individual object is referred to ass an 

tures into external ones that can be passed back to a client 65 "OrgNode" (Organizational Node). A typical Response 

application. It also wraps all method calls into the Response installation may have a few Types of OrgNodes, where each 

server in TransBlocks and has them executed by Transac- OrgNode Type may have different fields or store a different 
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type of data. Some examples of OrgNode Types would be LDAP OrgNodes would be created on the fly when sub- 
Users, Nodes, Locations or Business Departments. All the systems requested them by supplying a key to the User Type. 
OrgNodes of a specific Type can be grouped hierarchically The fact that some of the User OrgNodes returned came 
or as a simple flat list. Certain types of data lend themselves from the Object database and others from LDAP would be 
to being arranged hierarchically, such as Business Depart- 5 invisible to the application. 

ments while other types, such as Users, make sense as flat The iyp e a ]so stores references to Customization 

lists. Each type of OrgNode is referred to as a Type in classes. For each OrgNodeBag that a Type has a reference to, 

Response. it mav a iso have a reference to a Customization class. The 

The dblayer package contains most of the classes that are customization class may be specific to each type of 

stored persistently in the database. There arc a few 10 OrgNodeBag. For example, the SQLOrgNodeBag has a 

exceptions, which will be discussed later. The OrgNode customization class called SQLOrgNodeCustomization, 

class in this package is the abstract superclass for all which stores configuration data such as the database host, 

OrgNodes. There is a class called DefaultOrgNode, which is por^ username, password and schema. The Default- 

a concrete OrgNode that can store only one field, a name. It OrgNodeBag has a customization called 

also allows the administrator to add additional fields to each 15 DefaultOrgNodeCustomization, which stores the additional 

Type of OrgNode that uses DefaultOrgNode. Other field definitions for its DefaultOrgNodes. 
OrgNode classes, such as Rota, extend DefaultOrgNode and 

provide additional functionality. Still other OrgNode classes, Creating New OrgNodes 

such as SQLOrgNode are special in that they don't actually m „ , <. ^ kr „ ^. „ 

contain any data. Instead, they just contain a unique key into 20 ™ e JyP e class "** a factor y for Grades of its Type, 

an external SQL based database and retrieve their fields Therefore, to create a new instance of an OrgNode one 

when queried by another subsystem. Because of this, one n f ver actuall y caUs ihe constructor for the specific OrgNode 

can write additional OrgNode classes that get their data from class one wants to instantiate. Rather, one gets a reference to 

any type of database on the fly. This will be discussed further T ?P e bom T yP eLlst «? d ^ instantiate OrgNode ( ) 

in the section about OrgNodeBags. 25 on * ? mc * a ^ may contain more than one OrgNodeBag 

The abstract superclass OrgNode provides a few methods md therefore, more than one class of OrgNodes (each 

that must be implemented in all subclasses. These methods OrgNodeBag can return references to specific classes of 

give all OrgNodes certain properties. First, they each have a OrgNodes), there is a default "creation OrgNode class 

name and key. The key is a unique string that distinguishes defined b y e * ch ^ * l VP e of that is 

each OrgNode. The name is often the same as the key but 30 instantiated by the Type when instantiatcOigNodc ( ) is 

doesn't need to be so. It can be thought of as the display calle * * xam T p1 ?' ' f V ™ T £?? T ^^J™ 

namc one DefaultOrgNodeBag and one SQLOrgNodeBag, when 

Hiere are two types of relationships between OrgNodes: instantiateOrgNode ( ) is called on the .Type a Default- 
children and links. Children allow OrgNodes to be arranged OrgNode might be created if the creation OrgNode class was 
in a hierarchical manner, suitable for bubbling up through 35 set to DefaultOrgNode. 

business departments or locations. Links allow the arbitrary APIs There have been two APIs described in the previous 

association of OrgNodes of different Types. For example, a section: The OrgNode API and the OrgNodeBag API. These 

User may be linked to a particular business department. For two APIs work together to allow a programmer to create new 

OrgNode types that are stored in a flat list, such as users, types of OrgNodes whose data may be stored in any external 

typically, one might arrange them in a hierarchy by linking 40 datasource. The OrgNode API is implemented by extending 

them up to another Type of OrgNode that is arranged the abstract dblayer. OrgNode class by implementing all the 

hierarchically, such as Business Departments. One might abstract methods such as cnumerateLinks ( ) and enumer- 

link a User up to each OrgNode in the Business Department ateChildren ( ). (See the javadoc for all the actual methods), 

hierarchy. By implementing these methods, the programmer can define 

45 how the children and links of the new type of OrgNode 

Types, TypeList, and OrgNodeBags should bc rctr icved. For some datasources, enumerateChil- 

There is a singleton class called TypeList that can be dren ( ) may not make sense. In that case, the programmer 

accessed from the ConfigRepository (which is pulled from may simply return Util.getEmpty Enumeration ( ), which 

ObjectRetriever), from which OrgNodes can be retrieved or returns an empty enumeration. It will appear to the rest of 

added to. The TypeList is the central root from which all 50 Response as if the OrgNode has no children. The same 

OrgNodes can be reached. The TypeList contains references applies for links. An example of this is SQLOrgNode, which 

to many instances of the Type class. Each instance of the returns links based upon the 

Type class contains references to one or more OrgNode- SQLOrgNodeBagCustomization, which allows the user to 

Bags. define which fields in the table should be used as foreign 

The interface dblayer. OrgNodeBaglfc is implemented by 55 keys into other Response Types, 

each type of OrgNodeBag. The function of an OrgNodeBag The corresponding OrgNodeBag API is implemented by 

is to allow one to add and retrieve OrgNodes from a defining a class which implements dblayer.OrgNodeBaglfc. 

datasource. It has methods such as getOrgNodesFromKey ( This class is responsible for retrieving OrgNodes from its 

) and add ( ). An OrgNodeBag for a particular datasource is datasource. It may either return OrgNodes that are stored 

responsible for knowing how to pull OrgNodes from the 60 statically in a database (as in the case of 

datasource based on a supplied key. This allows all DefaultOrgNodeBag, which returns DefaultOrgNodes from 

Response subsystems to access OrgNodes that may contain the ODI object database), or it may create OrgNodes on the 

data from disparate databases without any knowledge as to fly based on data, retrieved from another database (as in the 

where the data originated. Since a Type may pull OrgNodes case of SQLOrgNodeBag). The programmer may also 

from multiple OrgNodeBags, one could have a situation in 65 implement the add ( ) method to allow Response to add new 

which the User Type pulls some of its Users from the Object OrgNodes to the datasource. This may or may not make 

Database and others from another source such as LDAP. The sense for any given datasource. 
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Certain OrgNodeBags which provide access to read-only This abstraction of OrgNode references allows any OrgNode 

datasources may wish to allow users to create links to and to hold a reference to an OrgNode that may need to be pulled 

from objects in the back-end datasource. The method used to at runtime from another datasource. Since OrgNodeldenti- 

achieve this, as implemented in SQLOrgNodeBag, is to fiers can be expressed as a string, any datasource capable of 

store the link information in the Object Database but keep 5 storing strings, can store references to OrgNodes in any 

the actual data in the backend datasource. We refer to these other Response datasource. In this way, a web of objects 

special links stored in the Object Database to data in another residing in many different databases can all be woven 

database as "shells", since they are really just pointers to together and accessed by Response as a composite database 

data stored elsewhere and also act as a concrete object which without any duplication of data. 

stores links out to other objects. 10 [ n addition, an OrgNode's children are stored and 

There are other examples of OrgNodeBags and OrgNode returned as OrgNodeldentifiers. Although this doesn't have 

classes act as proxies to access data in other Response as obvious a purpose as storing links as OrgNodeldentifiers, 

subsystems. One example is AuthUserOrgNode and AuthU- it allows for the flexibility of storing different branches of a 

serorgNodeBag. These allow the users returned by the tree of OrgNodes in different databases. Currently, there is 

authentication module (discussed previously) to be treated 15 no example implementation that does this, but it is possible 

as OrgNodes by the rest of Response. given the infrastructure, 



Client/Server Interaction: Mementos and Identifiers 

The OrgNode classes stored in the database are only 
meant to be accessed from within the Response server 20 
process. Although OrgNodes could be serialized and sent to 
the client for display and editing, we felt a cleaner solution, 
especially considering the openness of the API, was to 
provide a client side version for every OrgNode. One of the 
main reasons for this was the fact we didn't want any classes 25 
used by the object Database to be referenced on the client 
side. ODI provides some collection classes that are back 
ended by C++ code, to achieve fast searching and indexing. 
As a result of this, they are not Serializable using standard 
Java Serialization. To enable the data residing in classes 
which use these collections to be viewed and edited on the 
client, there exists a Memento class for each OrgNode class. 
The Memento classes are client side copies of the data 
retrieved from the OrgNodes residing in the datasources. ^ 

In addition to having OrgNodeMementos for each 
OrgNode, another type of class called an OrgNodeldentifier. 
Whereas an OrgNodeMemento actually contains all the data 
from its corresponding OrgNode, an OrgNodeldentifier only 
holds a pointer to an OrgNode residing in the server. 4Q 
OrgNodeldentifiers are used as references to OrgNodes. 

Example: GUI editing of an OrgNode — For example, 
when the GUI needs to display a list of all the OrgNodes of 
a specific Type, it makes a request to the Response server. 
The Response server sends back an array of 45 
OrgNodeldentifiers, each of which contain the display name 
and key of an OrgNode. The GUI displays these OrgNo- 
deldentifiers on the screen. When a user wishes to edit an 
actual OrgNode, he clicks on the OrgNodeldentifier. The 
GUI then asks the server for the OrgNodeMemento by 50 
sending the OrgNodeldentifier. The user then edits the 
OrgNodeMemento. When the accept button is clicked, the 
GUI sends the OrgNodeMemento back to the server. The 
server finds the OrgNode pointed to by the OrgNodelden- 
tifier embedded in the OrgNodeMemento and calls accept- 55 
Memento ( ) on the OrgNode, passing the modified OrgNo- 
deMemento as an argument. The OrgNode then changes its 
state to match that of the OrgNodeMemento. In this way, 
clients can modify data residing in various data sources 
without having any datasource specific classes sent over the $o 
network. 

OrgNodeldentifiers as Links 

Another use of OrgNodeldentifiers is in the storage of 
links between OrgNodes. Instead of actually storing refer- 65 
ences from one OrgNode to another, each OrgNode hold 
lists of OrgNodeldentifiers, which point to other OrgNodes. 



GUI Design Patterns 

There are several patterns that are common throughout the 
various components of the GUI. The com.micromuse.com- 
mon.awt widgets, which are built on top of the JFC/Swing 
widgets are used in all screens. These widgets provide extra 
convenience methods as well as a more common look and 
feel throughout all screens. They ensure all fonts, colors, 
sizing, and borders are uniform. For convenience, they 
provide extra functionality such as built in models and scroll 
panes for widgets such as JLists. Another package that is 
used extensively is the com. micro muse, common, command 
package. This package provides an abstraction for blocks of 
code that need to be called by more than one GUI gesture. 
It also takes care of exception handling and ensures that 
exceptions resulting from gui gestures are bubbled up and 
displayed in a dialog box. The common .util.Debug class 
takes care of debug messages and allows redirection to a file. 

Editor/Viewer Infrastructure 

A reoccurring pattern in all Response client classes is the 
ability for the class to provide its own editor and viewer 
GUI's. The most obvious use of this is for OrgNodeMe- 
mentos. Each OrgNode has a corresponding client side 
OrgNodeMemento, and each OrgNodeMemento has its own 
editor GUI and viewer GUI. The editor GUI is displayed 
when the OrgNOde is selected for editing in the configura- 
tion screen. The viewer GUI is displayed when the OrgNode 
is sent, as a result of an operator query, to be displayed in the 
Operator view. Typically, these are the viewers that are seen 
when an operator clicks on an event in OMNIBus and 
wishes to see all the OrgNodes associated with the event. 

Since a user may click on many different instances of the 
same type of OrgNode, the editor/viewer infrastructure 
doesn't require the client to rebuild a new GUI every time 
another object is selected. Instead, it caches editors or 
viewers that have already been instantiated and reuses them 
to display the newly selected OrgNode. As a result, the gui 
component for the editor or viewer is only instantiated the 
first time a new type of OrgNode class is displayed. 
Thereafter, the editor is told to setCurrentObject ( ) to update 
its display. This editor/viewer API is contained in the 
common. editor package. 

To create new objects that are editable and viewable using 
this infrastructure, a programmer needs only to implement 
the common. editor.UIable interface, which has a few meth- 
ods such as getName ( ), getlmageName ( ), and getUIFac- 
tory ( ). A UIFactory is a class which has two methods: 
getEditor ( ) and getViewer ( ), which return the Editor class 
and Viewer class, respectively. The reason for having a 
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separate UIFactory class it that this UIFactory class may be The Service Registory screen provides a view of which 

sent over the network from the server to a client. This services are registered along with the status of each. When 

particular feature is not used for viewing and editing a service is clicked on, the service viewer displays the log for 

OrgNodes, but it is used for the Services registry, which will the selected service. The log is active, so if the service is 

be explained later. 5 running, its output will be streamed into the log viewer. This 

As alluded to in the last paragraph, the editor/viewer API is done using the previously described ORBPublisher/ 

is used for more than just displaying OrgNode editors and ORBSubscriber update scheme. Along with the log, start and 

viewers. It is used for objects throughout Response. Some sto P buttons are provided to control the activation of each 

other examples are the Customization classes for each Type, service. 

as described in the section about Types and OrgNodeBags. 10 The service configuration panel provides a configuration 

In this example, each OrgNodeBag/OrgNode class can have screen for each service. Every service can define its own 

its own GUI for configuration. One example of this is the GUI for configuration. In addition, this GUI can have active 

SQLOrgNode/SQLOrgNodeBag customization screen, buttons that invoke functions in real time on the service 

which allows the administrator to enter the JDBC host/ running in the Response Server. The standard used for 

usemame, table and fields. Another example is the Defaul- 15 saving configuration data for individual services are the 

tOrgNode customization screen, which allows the adminis- Con figReposito ry.se tProperty and getProperty methods, 

trator to add additional fields and reorder the objects in the These methods allow each service to store its parameters in 

bag. Another use of this will be explained in the discussion its own file, named <servicenamc>.props. Since these are 

of the Service registry, in which each Service can have its text files, administrators can edit these files using a standard 

own configuration screen. 20 text editor. This is only a standard; it is not hard coded, as 

The key to making it simple to create dynamic GUIs in eacn service can implement its own methods for setting and 

which one part of the GUI changes as different objects are getting configuration data. Therefore, the configuration 

selected is the use of the EditorSwitcher class. An Editor- screens can dynamically apply changes to the service, even 

Switcher is a GUI component that implements the Editor # ^ k already running, 

interface. It caches the instantiated editor components and 25 . 

switches the proper GUI to the foreground when told to RemoteServicelnterfacelfc 

display a particular object. It also has a read ( ) method ^ flexibility provided by the Service configuration 

which calls the read ( ) method on the editor that is currently screen ^ made possible by the use of RemoteServicelnter- 

in the foreground. The read () method tells the editor to set faccs . A RcmoteServicelnterface is an RMI remote class 

the state of the object being edited based on the state of the re tumed by each service running within Response. This 

GUI. A top level editor such as an OrgNodeMementoEditor rcmotc interface can be requested by the client (or any other 

may also call a method in ORBClient ( ), such as ORBCli- subsystem) to allow methods to be called on it remotely. 

ent.acceptOrgNodeMemento() to actually send the changed sincc tnis interface is retumed by the service, it can be 

object back to the server to be saved. ^ subclassed and customized to provide special functionality 

. for each service. The interface which must be implemented 

rvice is server.RemoteServicelnterfacelfc. It has methods that are 

Ihe aforementioned sections described how data is orga- necessary for all services, such as startrunning ( ) and 

nized using OrgNodes and how the transaction layer func- stopRunning ( ). Basically, it has methods to provide access 

tions using TransactionManager. Thus, the infrastructure has 40 10 aU me methods in the Service interface. For example, it 

been formed upon which applications can be built. Since one provides startRunning ( ), stopRunning ( ) and getStatus ( ) 

of the original intentions of Response was to perform many methods. It also has an addStateChangeSubscriber ( ) 

different functions leveraging the same pool of data, it was method which allows a component such as the Service 

necessary to provide an API through which a particular Registory GUI to add itself as a subscriber to the service so 

application could interface with the data and the user. 45 mat when the service's status changes, the GUI can be 

Furthermore, we knew it would be necessary to have the updated immediately. This eliminates the need to poll the 

ability to write new applications which add functionality and server for service status and ensures the administrator will 

drop them into existing Response installations without dis- alwa y s Qave an U P to date view ^ t0 which services are 

rupting the running server. The Service API provides these running, 

abilities. 50 

A service is a process running within a Response server 

that has access to the repository of OrgNode data and can The ability to provide different GUIs for each Service is 

communicate with all other services running in the same accomplished using (he Ulable interface, just as the 

Response server. Any process that needs to run within the OrgNode viewers and editors use. However, services make 

Response Server can be written to implement the Service 55 use of the fact that a Ulable object returns a UIFactory 

interface. The server.Service interface has a few methods instead of an actual instance of the GUI component itself. A 

self explanatory methods such as startRunning ( ), stopRun- class called ServiceMemento is returned by the Respons- 

ning ( ) and getStatus ( ). These methods allow any service eServer for each Service that the client wishes to configure 

to be managed by the ServiceManager. The server.Service- or view the log for. ServiceMemento is not subclassed for 

Manager class provides a static API to start and stop any 60 each Service, as OrgNodeMemento needs to be subclassed 

service by name, as well as logging facilities for all services. for each OrgNode. This is not necessary for services since 

Each service can have its own log maintained. ServiceM- the purpose of a ServiceMemento is not just to send static 

anager keeps track of which services are registered and data back and fourth, but to provide an active GUI for the 

allows the administrator to add new services by providing service. To accomplish this, it contains the UIFactory for the 

the name of the class which implements the Service inter- 65 particular service as well as a RemoteServicelnteface to the 

face. In this way, new functionality can be added on simply service running in the client. It also contains the log for the 

by adding a new service. service up until the point the client requested it. When it 
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arrives on the client side, the client asks the UIFactory in the the actual code to be executed. The doit ( ) method for 

ServiceMemento for a viewer and editor. The viewer is the EmailReader pops the email from the mailbox and passes it 

screen containing the log and the start/stop buttons. The to the MessageAcceptor subsystem, which will be defined 

editor is the configuration screen. Next, the RemoteServi- later. To subclass Rooster, EmailReader calls Rooster's 

celnterface is given to these two GUI components so they 5 constructor with an reference to its Command class, and the 

can communicate with the service running in the Response period, which is by default 30 seconds. Rooster was defined 

Server. to be abstract since other Services that need to run periodi- 



Service Logging 



cally also subclass it. 
10 Services Just for Configuration and Logging 



As soon as the ServiceMemento arrives at the client, it 

connects back to the service running in the Response Server EmailSenderService is an example of a Service whose 

and adds itself as a log subscriber. The Service viewer then sole function is to provide a configuration screen and 

subscribes to the ServiceMemento. In this way, log data logging for a particular Response subsystem. The Email 

from the Service is sent to the ServiceMemento in the client, sender doesn't actually need to be run periodically — it runs 

and the service viewer displays it. This reason this multi- 15 w ^n it is called by the SendEmail action (to be described 

tiered approach was taken is that whenever a service is later). However, it does need a GUI to allow the adminis- 

selected in the Service Registry, it does not have to down- trator to configure the outgoing SMTP host. By creating a 

load its entire log from the server, as each ServiceMemento simple service whose startRunning ( ) and stopRunning ( ) 

continues receiving log updates even if it not displayed. This methods don't do anything, we were able to provide a GUI 

mechanism could be modified if scaling proves the traffic 20 for the EmailSenderService without having to add any code 

generated by log updates to be an issue. However, an or additional screens to Response. Its log facility is also used 

important consideration to be made is that the current design 10 provide the administrator with a log of emails that have 

could allow multiple services to be viewed in different been sent, 
windows simultaneously. 

25 EventBroker Real Time Event Processing 
Subclassing RemoteServicelnterface The most intricate Response service is the EventBroker. It 
Although the RemoteServicelnterface for a particular provides Response's real-time event processing. It is the 
service must provide some complicated functionality, a gateway between the real time event feed from the Object- 
developer designing a new Service doesn't need to imple- 30 scrvcr and tne acti °n tree processing subsystem (described 
ment all this functionality from scratch when writing the ^ tne Action Trees document). The event.ObjectServer- 
RemoteServicelnterface. Instead, he can simply extend Driver class connects via JDBC to the ObjectServer and 
service.RemoteServicelnterface, which implements Remo- P olls for new events usm S ^ StateChange, field. The 
teServicelntefacelfc and provides all the basic functionality Parameters are configured using the EventBrokerEditor 
such as proxying the start/stopRunning ( ) methods and 35 GUl > which * the GUI for the EventBroker service. When- 
getStatus ( ) methods to the corresponding Service. If the ever new events are read > are P laced in a buffer 311(1 read 
service doesn't required any special configuration methods one at a ^me by the EventBroker. The EventBroker pack- 
for its config screen, the developer can simply return an a 8 es each evenl " an Stance of the ObjectServierEvent- 
instance of RemoteServicelnterface directly, without even Container class. This class is simply a hashtable of field/ 
subclassing it. 40 va ru e P^rs with some added functionality to support 

flagging of modified fields. The EventBroker also has a 

Other Uses for Services putEvent ( ) method which can send the modified fields in an 

EventContainer back to the ObjectServer. These fields may 

Another use of the Service API is for an OrgNode viewer be modified by an ActionTree that is performing event field 

or editor to display actively changing data. An example of 45 substitution or adding add journal entry for a particular 

this is the SLAM prototype, which uses the RemoteSLAM- event. 

Rooste^rServicelnteface to have service level updates pushed The EvenlContainer is pasS ed to trigger.ServerMessag- 

to it. Basically, the service API provides a general way for cSender ServerMessageSender packages the event in the 

any client side component to communicate with any server CO mmon.Message class, which encapsulates an event along 

side component without requiring any Response classes to 5Q what type of event it is ^ type of the event determines 

be modified. what shmild be done with lhe event For examp i e> an 

A L , „ „ j ■ _ ~ incoming e-mail and an event from the Object Server are 

Actual Services: EmailReader and Rooster both {QCQming eveflts> ^ functions are performed 

A number of Services currently exist for Response in on them. ServeMessageSender is responsible for passing 

addition to SLAM. A simple example of a service is the 55 Messages to the MessageAcceptor class. MessageAcceptor 

EmailReader, which checks an emailbox every so often. Its places all incoming Messages that need to be processed in a 

UIFactory returns an instance of clientEmailReaderEdilor queue. 

as its configuration screen (editor), which allows the admin- A class called MessageProcessor is the consumer of the 

istrator to configure the POP server, username and port. Messages in MessageAcceptor' s queue. For each Message it 

EmailReader subclasses a service called server.Rooster. 60 reads from the MessageAcceptor queue, it executes the 

Rooster is an abstract service which executes a particular proper Action Tree on the event contained in the Message, 

piece of code periodically. It is similar to cron, except it is There is a special instance of MessageProcessor in the 

not a full fledged scheduler. Future versions of Rooster could ResponseServer that is reserved for Messages that need to be 

add scheduling functionality to run the service at specified processed immediately, as opposed to being put in the 

times. EmailReader defines an instance of the common.com- 65 queue. This is used for events that are sent by an operator 

mand.Command class, which is similar in functionality to who wishes to get immediate feedback. ServerMessag- 

TransBlock, in that it has a doit ( ) method overridden with eSender takes a boolean argument called needJmmediateRe- 
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ply which determines whether the Message being sent will Message, it loads the root Action Node in the Action Tree 

be processed by this special reserved MessageProcessor. and activates it, passing the event encapsulated in the 

Distributed event processing with multiple message as a variable in the incoming VarList called "Event- 

MessageProcessor — Multiple instances of MessageProces- Container". (See the Action Tree document for a detailed 

sor can all process events from a single MessageAcccptor s description of VarList). 

queue. In fact, not only can a ResponseServer have multiple . 

MessageProccssors (with each one having its own thread), llie AcUon Packa g e 

but Messageprocessors can actually run on different The action package contains classes that pertain to Action 

machines and all process events from the same Message- Modules and their execution. 

Acceptor. Using this capability, Response can be scaled to ™ The ac tion.Action class is the abstract superclass for all 

process many more events per second than a single Action Modules. While executing, an action can "post" 

Response Server could handle. Since each MessageProces- results mat be returned when the action tree finishes 

sor makes its own connection to the database and executing. This is how action trees that return OrgNodes to 

datasources, having multiple MessageProcessors does not the client return their results. The Action superclass provides 

impose extra load on the single Response Server. The only 15 ^^^y for post ing results (using the postEscalation- 

performance bottleneck is the single EventBroker which Resu it ( ) method) as well as for returning events to the 

reads events from the Objectserver into the MessageAccep- ob j ccl mc rctU rnEvent ( ) method. This facility 

tor queue. Since each VM can have its own connection to the ^ t> y me ReturnEvent Action, which is used for event 

database, running multiple MessageProcessors in different field substitutions. Logging is done using postResult ( ), 

VMs gets around OSJFs limitation of only allowing one M w hich takes a string. These log messages can be viewed with 

transaction per VM and allows events to be processed in me Escalation GUI if the proper level of debug is turned on. 

parallel. Eventually, these logs will be redirected through the Service 

Currently, event substitutions (EventBroker.putEvent ( )) API. 

are all fed back to the single EventBroker, so another The Action class also defines the methods getArgParams 

bottleneck is updating events. This could easily be reworked 25 ( ^ getRetumParams ( ), and getDesc ( ) which require 

to allow each MessageProcessor to open its own connection subclasses of Action to expose the arguments they expect in 

to the ObjectServer. The reason this would be difficult to do meu - incoming VarList context, what they return and a 

for reading events is that it would be difficult to ensure that description of what they do. Currently, the only data exposed 

two EventBrokers didn't process the same events. Even by these methods that is actually displayed is getArgParams 

here, it would be possible to setup each EventBroker with ( ). The "Build Expression" button on the Action Tree editor 

mutually exclusive filters to spread the load. g Cts the list of arguments that the selected Action module 

As Response stands now (July 1998), support for distrib- expects and displays them in a GUI, allowing the user to 

uted event processing is technically possible but not fleshed enter a value for each one. In the future, the Action Tree 

out in terms of ease of configuration. The service API is not 35 editor should make more use of this data to facilitate the 

designed to aggregate log information from services running building and error checking of Action Trees, 

in different VM's so error messages arising from Mes- Each instance of an executing Action Tree has an esca- 

sageProcessors in different VMs would not show up in the lation number. The escalation number is used for logging 

central EventBroker log. Since these issues would need to be purposes, for returning data, and to keep track of what is 

fleshed out prior to really making distributed event process- 4Q being done to each particular event. Each new event gets 

ing part of the Response release, a possible scenario may be assigned its own escalation number before its action tree is 

for distributed event processing to be pushed from version spawned, action. ActionTracker is a singleton class that 

1.0, but is architecturally possible. assigns new escalation numbers and keeps track of all the 

running escalations with an instance of Escalationlnfo for 

Action Trees ^ each escalation Escalationlnfo extends ActionResultHolder, 

The Action Tree document explains how Action Trees which is the actual class that stores the results returned by 
work on a high level. The following sections assume the the escalation, 
reader is familiar with the concepts described in that docu- 
ment. This document will address how the systems works Hibernations 
from a technical perspective. 50 One particularly interesting Action Module is Hibernate. 

The dblayer.ActionNode class, as well as the dblayerAc- The Hibernate action triggers a process which saves the state 

tionDecisionBranch class extends dblayer.OrgNode. This of the currently executing action tree to the state database 

means they can be treated by Response as regular OrgNodes. and stops executing, resulting in the action tree going to 

They can be linked to other OrgNodes and viewed by the sleep or into "hibernation". This action plays an integral part 

graph viewer since an Action Node's branches are exposed 55 in action trees that that stop and wait for something to 

through the OrgNode API as children and a branch's target happen. Atypical example is an action tree which e-mails an 

ActionNode is exposed as a child. The ActionTree Editor is administrator and then hibernates, waiting either for an 

just a specialized editor tailored for creating ActionTrees, a-mail from the administrator to acknowledge the event, or 

but technically speaking, the regular OrgNode configuration for a timeout, causing the action tree to escalate the event to 

screen could be used, although it would be more cumber- 60 the next administrator. 

some. The Hibernate action calls the saveState ( ) method in the 

All executions of ActionTrees are spawned by a Mes- Action superclass. This creates an instance of 

sageProcessor. When a message is received by a dblayer.ActionTreeState, which encapsulates the state of the 

MessageProcessor, it determines what to do based on the currently executing action tree by saving the VarList context 

type of the Message. There are two types of Messages that 65 along with a reference to the action node that it is up to. A 

are currently used. The more basic one is Message. AC- reason for the hibernation, the escalation number, and a 

TIONNODE. When MessageProcessor receives this type of reawaken time are also saved. The reason can be displayed 
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in the Escalation viewer, which is just a debug screen used Copies are made to ensure that no direct cross-database 

to see what Action Trees are currently in hibernation and references exist. This is because cross-database references to 

what time they are scheduled to reawaken. The Action- ODI persistent objects require the objects to be "exported", 

TreeStateRepository is the class that actually stores the a timely process. Instead, copies are made of all objects 

collection of ActionTreeStates. The ActionTrceStates are 5 except OrgNodes. When OrgNodes are found in the context, 

indexed by an integer called an ActionKey. This number is mcy are replaccd by OrgNodeldentifiers, since OrgNo- 

uscd to find and reawaken a hibernating action tree The deldentifiers are meant to be external pointers to data in the 

AcUonTreeStateRepository alsostores the ActionTreeStates ^ databasc A^^y since somc of mc OrgNodes in 

m order of their wakeup time. The server.EscalaUonRooster the action tree CQntext Mt actuaU be ^ anyway 

Service, which runs penodically tells the ActionTreeS- 1Q (thcy may have been generated dynamically by a bag such 

tateRepository to reawaken any hibernation whose wakeup ^ S QLOrgNodeBag), it is necessary to store all OrgNodes 

time has passed. No searching is necessary since the Action- as OrgNodeldentifiers. This step also gets around the prob- 

TreeStates are ordered by wakeup time. If a hibernation is km of havi tQ me data stored ^ m OrgNode 

woken up by the EscalationRooster a variable called between databases. OrgNodes should never be copied-only 

WakeupReason is mjected mto the VarList context with the 1$ [qs q{ OrgNodeldentifiers should be made and shipped 

value ' EscalationRooster' . This aUows a branch that is around When me hi5ernation is reawokeil) th e QrgNo- 

executed after the hibernation is woken up to determine if it deIdentifiers ^ the are transformed back into 

was woken up because of a timeout. OrgNodes before the executing of the action tree is resumed. 

Another way for hibernations to be woken up is by 

receiving a "wakeup call". A wakeup call is the other type ^ Determining Action Tree Flow Dynamically 
of message besides Message ACTIONNODE that can be 

sent by ServerMessageSender. The message type for a In some situations, one might want to configure an action 

wakeup call is Message.WAKEUPCALL. When Mes- tree whose execution flow is determined by the data it 

sageProcessor receives such a Message, it gets the variable traverses. An example of this type of scenario would be the 

from the VarList context in the Message's event called 25 situation where each user has a different contact method and 

"ActionKey" and uses it to look up the hibernation that each contact method is carried out by different action tree. In 

needs to be woken up. The "ActionKey" variable should be sucn a situation, one cannot create a single monolithic action 

set by the service that is generating the wakeup call. The tree unless one * willing 10 create branches to every possible 

only generator of wakeup calls at the moment is the Email- contact action tree and branch on a special variable in the 

Reader service, which gets the ActionKey by parsing the 30 OrgNode. A more dynamic approach is to take 

subject field of the e-mail received. It looks for an integer advantage of the fact that ActionNodes are OrgNodes and 

following a hash mark (#) in the subject. The EmailReader can have Unks - ^ ™ GT 00111(1 ^ U P nis preferred contact 

generates an EventContainer in which it stores the various method ActionNode to himself and the action tree could find 

parts of the e-mail. The fields set in the EventContainer are: a °* tv P e "Action" linked up to the user's OrgNode. 

"Subject", which stores the subject, "Body", which stores 35 mc Activate action can be used to transfer control to 

the body, and "Sender", which stores the sender of the me ActionNode that was found, causing the user's preferred 

e-mail. This EventContainer is placed in the VarList context contact method to be executed. 

of the wakeup call in a variable called WakeupEvent. This Another example when this technique can be used is when 

allows the action tree that is being woken up to branch based it is necessary to execute different parts of an action tree 

on data from the received e-mail. A typical application of 4Q based on the event. For example, one may want to find the 

this ability would be to parse the e-mail received and administrator hooked up to the OrgNode found from the 

acknowledge the event if the user replied "OK" or to ©Agent field in the event or from the @Node field, depend- 

escalate the event if the user replied "ESCALATE". ing on the value of the @AlertKey field. If ©AlertKey- 

The FindEscalationsByActionKey action gives an Action "router", the lookup should be done based on the @Node 

Tree the ability to look up a hibernation by Action Key. Once 45 field. If @Alertxey="app", the lookup should be done based 

the hibernation is found, the ActivateHibernation action on the ©Agent field. 

wakes up the found hibernation and transfers control to it. To solve this problem, create two Action Trees. The first 

Using these actions, an event received from the Object one does a lookup based on the value of the ©Agent field. 

Server or sent by an operator can be used to trigger the The second does a lookup based on the value of the ©Node 

wakeup of an action tree that is hibernating. In such a 50 field. Then, create a response lype called ActionKey and 

situation, the ActionKey would be stored in a field in the create two OrgNodes, named "router" and "app". Next, link 

Object Server. This is the scheme used in the 'Guided the action tree which does lookups by ©Agent to "app" and 

Actions' action tree, which stores the hibernation to be link the action tree which does lookups by ©Node to 

woken up in the ResponseActionKey field. "router". Then, configure the main action tree to do a 

Using ReturnEvent to update the ObjectServer, and 55 Lookup for an OrgNode of type "AlertKey", using the value 

Hibernate to save state, one can build very powerful work- of ©AlertKey as the name. From there, do a Lookup Links 

flow or problem management applications in Response that for an OrgNode of type "Action". Finally, do an Activate to 

are tightly integrated with the ObjectServer. In fact, if the activate the Action Tree that was linked to the AlertKey 

EscalationRooster Service and the SendEmail action are OrgNode. After this dynamically found action tree executes, 

used automatically, the entire event escalation process can 60 me administrator OrgNode will be left in the action tree 

happen automatically without operator intervention and context. 

progress can be monitored using the EventList. Such complicated action tree shouldn't be typical, but it 

Before we leave the subject of hibernation, a word must is possible to create them. The only drawback to such 

be said about their data storage. The Action .saveState ( ) dynamically constructed action trees is that one cannot fully 

process is quite complex because the entire action tree 65 visualize them since it is impossible to know which action 

context must be traversed deeply, copying certain variables nodes will be executed without actually executing the action 

and performing transformation on others along the way. tree. 
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There are about 15 other actions in the action package, To use REL to print out the first TuneBlock of the first 

most of which are pretty self explanatory. To find out what member, you could use the expression: 

each does, examine the getDesc ( ) method. Rota.members[0]. timeBlocks[0] 

Getting data from OrgNodes: REL and the VarGettable - n In Ro * is viable containing the Rota 

' ifAL *■ . c c *- OrgNode. We pull out the variable called "members from 

interface — As action tree execute, they perform functions n . ,» - - - . w . . - 

. . , „ , c 4 . rt ki j ^ j j R Qla » which returns an array of RotaMembers, each of 

using data pulled from the OrgNodes they find and traverse ^ ^ VarGcttablc Wc the ^ clemcnt ^ 

The REL language is used to pull values from OrgNodes and ^ [ ] ators? ^ described in me REL g ram mar. Now, we 

assign these values to variables in the context, to be used as havc a singk refcrcnce to a RotaMembcr> NcxU wc pull 01lt 

mput to other Action Nodes. (See the REL document for the io the "timeBlocks" variable, which is an array of TimeBlocks. 

specific grammar documentation). REL does not need to Finally, we reference the O'th timeBlock. We could go father 

know what type of OrgNode it pulling data from. It can pull pull out the starting time or ending of this "timeBlock" 

data from any OrgNode because all OrgNodes implement a s follows: 

the common.VarGettable interface. This interface has a few Rota.members[0]. timeBlocks[0].start 

methods, the most important one being getVar ( ). This 15 Qf 

method takes a string as a parameter, which is the name of Ro ta.members[0]. timeBlocks[0].end 

the variable to be pulled. Each OrgNode is responsible for ^ articular names of me variables mat can be pulled 

implementing this interface so as to fully expose as much of from each objcct afe exposed by the VarGettable interface 

its data as possible. ^ luia ^ the enumerate VarNames ( ) method. Using this 

In addition to returning strings or integers, the VarGet- interface, a GUI could be built to facilitate the creating of 

table interface can return any Object. This means it can REL expressions. 

return another VarGettable object, allowing an REL expres- VarGettable variables returned by all OrgNodes— There 

sion to extract data that may be deeply encapsulated in an are certain variables that all OrgNode classes expose 

object containment hierarchy. Through the use of REL 25 trough VarGettable. This functionality is provided in the 

expressions and the VarGettable interface, it is possible to OrgNode superclass. First, any method that returns a String 

traverse through object hierarchies and pull specific: peices can be accessed through VarGettable if it conforms to the 

of data. This feature will be an integral component in JavaBeans style method naming scheme. Namely, the 

providing full command line access to all Response data. method must be called getXXX( ), where XXX will be the 

30 variable accessible through VarGettable. 

Rota: Multi-level Object Hierarchy *" .V^" 1? t a 

J 3 method called getPersonalEmail ( ) and you wanted to send 

An example of such an object hierarchy is the Rota an email to the person's personal e-mail address. Assuming 

OrgNode. dblayer.Rota is a special OrgNode, which extends y° u wcrc ^ ■ REL l ° set the m P uts for thc SendEmail 

DefaultOrgNode, that is used to schedule a list of OrgNodes. 35 actl0n > y° u 00111(1 use * e expression: 

Each OrgNode has a series of TimeBlocks that define when Address-User.PersonalEmail; 

the particular OrgNode should be considered "on call". a few special variables returned by OrgNode. 

Since any type of OrgNode can be scheduled in a rota, one Tfie y are as follows: 
could use Rotas to have a different user selected based on the 
time, as well as different documents or severities. By sched- 



uling severities, an administrator could configure a system in m RchjrM ^ mmc rf ^ QrgNodc 

Which the severity of an event is determined by the time of lypc Return* the name of the type of the OrgNode (ex Rote or Node) 

day and day of week. This is Useful in situations when parent Returns the parent of the OrgNode (the actual OrgNode 

certain down events may OCCUr during scheduled downtime, reference, not just the name of the parent. Tb get the name of the 

and therefore may not be important. Conversely, events that 45 parent, use parentname;) 

occur during prime time hours may be more important. 

Instead of having to do the scheduling at the probe level, and DefaultOrgNode 's VarGettable Interface — 

therefore requiring the scheduling data to reside in many DefaultOrgNode and its derived classes allow the adminis- 

rules files, the administrator could have one central point of trator to add additional fields using the Customization button 

administration where all events relating to a particular 50 in the Type Registry. The data stored in these extra fields can 

service could be prioritized by time. be accessed through the VarGettable interface. The variable 

..... .rr».- rn names are the names of the fields defined on the field 

The object hierarchy for Rota is as follows: customization screeo. Note that the variable name is used, 

and NOT the display name. For this reason, it is NOT 
55 advisable to use fields with spaces in them, since they will 

Rota not be accessible from REL using the VarGettable interface, 

"many SQLOrgNode's VarGettable Interface — SQLOrgNode 

RotaMembcr a returns the values of the fields returned from the SQL 

OrgNodeidentifier ""^ TimeBlock database. The variable names are the column names in the 

(the actual OrgNode) 60 database, as defined in the customization screen for 

SQLOrgNodeBag. 

Operator Initiated Actions — Previously, we discussed 

Rota contains many instances of RotaMember. Each how the EventBroker reads events from the ObjectServer 

RotaMember contains a reference to an OrgNodeidentifier, and how they flow to MessageProcessor to be processed, 

which is the orgNode being scheduled. The RotaMember 65 This is known as real-time event processing. In our 

also contains a list of TimeBlocks, each one specifying one discussion, we mentioned the needlmmediateReply option 

range of time that the OrgNode is scheduled for. for the common .Message class. Its use is for operator 
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initiated actions. In this section, we will explore the flow of EmailAddress or TextMessage, when sending an e-mail. The 

operations for operator initiated actions. ActionTree editor allows the administrator to define certain 

A typical example of an operator initiated action starts User Parameteres that need to be entered before executing 

when an operator is viewing events in the Omnibus the action node. If the action node being viewed has any 

EventList. The operator sees a particular event for which he 5 User Parameters defined, the Action Node viewer will create 

would like to retrieve Response inform atioa He selects the a form which the operator must fill out before clicking the 

event, clicks on the Tools menu and selects "Response "Execute Action Tree" button below the form. When this 

Lookup". This tools is configured to execute a stub program button is clicked, the values in the form will be sent to the 

called EventTrigger, located in the trigger. EventTrigger server and the action tree will be executed. The values from 

class. The tools runs a script which passes all the field values 10 the form will be passed as input variables to the action tree, 

from event as command line arguments to the EventTrigger Sometimes there may be certain fields that should be 

program. In addition, it sends the %username% field to copied from the User OrgNode into the Action Node viewer 

identify which Response client should receive the data to be form as defaults. This can be arranged by defining User 

displayed. It also sends the name of the Action Tree that Parameters with the same names as the field names in the 

should be executed. This allows the administrator to con- 15 User OrgNode. The Action Node viewer will automatically 

figure different took, which run different Action Trees, each copy the values for any fields whose names match. An 

of which may lookup different information. So, a typical example of when this is useful is for passing the EmailAd- 

script run from the tools menu might look as such: dress field from the User OrgNode as the default EmailAd- 

java COM.micromuse.response.trigger.EventTrigger dress for the "Contact via mail" Action Tree. Note that the 

%username% 20 actual UserParameter names are used for matching and NOT 

"LookupResponseDataActionTree" Node ©Node Agent dis P la y name - So > even j f ^ UserParameter for the 

©Agent Summary "©Summary" Serial ©Serial Actl0n Node » Address because the Sendmail 

Severity ©Severity action requires a vanable called "Address", the field name in 

Hie EventTrigger program, running on the nco client Ac form could ^ oy/ U P M " Email Address", 

machine, connects to the central Response server and passes 25 ™ e mechanism for the Operator Viewer callback is 

these parameters. The Response server maintains a list of pubhsh/subscnbe based. When the Operator View screen is 

which users are logged in from each instance of a Response initialized, it creates a callback method which is an RMI 

client. The response server executes the action tree specified remote class - ™ c caflback method » registered with the 

by the EventTrigger program, passing the event fields as Response server using the username as the client identifier, 

input to the action tree. When the action tree returns, the 30 ™* client identifier is the string sent as an argument to the 

results are passed to the client as OrgNodeldentifiers. The EventTrigger program. Currently, the username used to 

"Operator View" screen in the client displays buttons for kgm to Response is used to register the callback. However, 

each OrgNodeldentifier in a vertical row on the right side. * **'t flexible enough (due to multiple users logging in 

When one of the buttons is clicked on, the OrgNodeMe- ^ ^ me °***)> chent ldeD ^ T e ' ^ be s P ec lf ed 

mento is retrieved from the server and the viewer is dis- 35 on the command line to the Response GUI. This would allow 

played on the right side. EditorSwitcher is used to switch *f ^ e of a m °" u * im ! e identifier, such as a concatenation 

between various viewers and OrgNodeMementos. of *» user «"* X dls P la y host > or some 8011 of machme 

The viewer for each OrgNode (Memento) is different ID * 

from the Editor in that it is read only and specifically REL Primer 

designed to be used for the Operator View. Most viewers are 40 Purpose 

similar to the editors for their respective OrgNodes with a REL stands for Response Expression Language and its 

few exceptions. The Rota viewer provides a split view, primary function is to act as glue to tie together action nodes 

where the top of the viewer lists buttons for all the OrgNodes in an action tree. It can be used to map values to variables 

that are currently on call. When one is clicked on, its viewer i n an action tree context, which is passed from the output of 

is displayed in the bottom half of the viewer. 45 one action node to its branches, and then as input to 

The User OrgNode viewer is special in that it displays all subsequent action nodes. Since the outputs of one action 

Action Trees that are linked to the User OrgNode and tagged node may not align perfectly with the inputs of the next 

with the Action Node Attribute "Contacter". Action Node action node, it is necessary to do mappings to ensure each 

Attributes are flags that can be set on any Action Node. They action node receives the correct inputs that it requires, 

are simply used to specify what purposes a particular Action 50 Additionally, it may be necessary to allocate temporary 

Node can be used for. Typically, one may link up various variables in which to store values that may need to be 

contact method action trees to a User. One might be "Con- re-used. This is typical in a bubble-up action tree, where you 

tact via E-Mail", and another may be "Contact via Pager". may need to save a reference to the last business unit 

Both of these Action Trees would have their root action node encountered to enable you to return to it later to bubble up 

flagged with the Contacter Action Node Attribute. The list of 55 the hierarchy, 
available Action Node Attributes can be modified in the 

Administration screen. Action Nodes can be flagged with an rammar 

Action Node Attribute in the Action Tree Editor. REL grammar is similar to a scripting language such as 

The User OrgNode viewer has a box in which buttons are perl or unix shell. There are two distinct parts to a REL 

created for each Action Node linked to the User that is a 60 assignment expression: the left side and the right side. The 

Contacter. When one of the buttons is clicked on, the viewer left side is the variable to be assigned to, and the right side 

for the Action Node is displayed in the bottom half of the is the expression to be evaluated and assigned to the variable 

User viewer. The viewer for an Action Node is another on the left. Assignment expressions are always followed by 

viewer that is very different from the Editor. The Action a semicolon. A typical assignment might be: 

Node viewer is specifically designed for launching the 65 EmailAddress-"admin@mydomain.com"; 

action tree. Sometimes it may be necessary for the operator Here, the variable to be assigned to is "EmailAddress", 

to include certain parameters for the Action Tree such as and the value to be assigned to this variable is the text string 
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"admin@mydomain.com". Literal strings are always or 

enclosed in quotes. You may also reference other variables OrgNode -OrgNodes [0]; — Assigns the zero'th element of 

on the right side and concatenate them using the +operator OrgNodes to the OrgNode variable, 

as follows: or 

Problemo"Nodc went down/'; 5 TypeNum=l; 

TextMessage="You are being e-mailed because: "+ Type a Types [TypeNum]; — Assigns the TypeNum'th 

Problem; element of Types to the Type variable 

Variables are untyped and do not need to be declared. Just Currently, you cannot assign directly to an index into an 

as you assign a string to a variable, you can assign integers: array as shown: 

Severity«5; 10 TVpes[l]="Rota";— This currently will not work 

Severity-Severity+1; REL Evaluation Expressions 

Severity-Severity-2; REL can also be used to evaluate boolean expressions in 

Valid operators for integer manipulation are +, - and*. If a similar fashion to SQL. This is how REL is used to 

you try to mix integer and strings in an assignment, certain 15 determine which branches to execute after an Action Node 

rules determine the result. Generally, if you add an integer ^ executed. The same grammar which applies to the right 

to a string, the result will be a string with the integer hand side of a REL assignment expression is used for 

concatenated with the string. Other operations that don't evaluating expressions. For example, a simple REL evalu- 

make sense such as subtracting a string from a string will a ti 0 n expression is: 

just yield a runtime error (not a parse error!). 20 5«5— always evaluates to TRUE since it does not depend 

Severity«5; on any variables 

Problem«"Severity has exceeded"; Notice that there is no semicolon after a boolean evalu- 

TextMessage-Problem+Severity; alion expression, as no assignment is being done. The 

expressions on both sides of the logical comparison operator 

Variable Members 25 are evaluated and compared to return a boolean (either 

ry . . . , , , 4L . , t . ., . . TRUE or FALSE). More complex evaluations which take 

Certain variables can hold other variables, similar to how , . * • ui a u • ui ui 

. . A . . u l4 . . : . , . advantage of variables and member variables are possible as 

a perl associative array can hold multiple values mdexed on ^ # & 

string keys. One such example is the special variable * „ „ , , 

r *s> * • u- u . *r .i Node= mvbox — evaluates to TRUE if Node contains the 

EventContainer, which represents an event from netcool or 30 . ^v uu * ^/ ^w^w wuuiaJlu 

from another source. An event is an object that is comprised string my ox 

of many fields. To access member variables, use a period, Agent- K diskagenr— evaluates to TRUE if Agent con- 

For example, to access the Node field from an EventCbn- tams the strin e "diskagent" 

tainer and construct a status message using it, you may OrgNode. parent! -NULL— evaluates to TRUE if the 

write: 35 member variable "parent" of the variable 

TextMessage="There was a problem with"+ OrgNode is NOT null 

EventContainer Node* Either side of the evaluation expression may contain any 

You may use variable members on the right side of an valld RE *- operators 

assignment expression. This example changes the Summary Position+1>5— evaluates to TRUE if the Position variable 

field of an EventContainer and uses the Severity member to 40 plus 1 is greater than 5 

construct the new value- You may also use boolean logical operators to perform 

EventContainer.Summary-"Severity has exceeded"* more com P lex evaluations: 

EventContainer.Severity; (Nodeo"mybox") AND (Agent="diskagenf )— evaluates 

Some variables have special members that can be t0 TOUE tf Node cc l uals m y box 

acccessed. For example, OrgNode has a variable accessible 45 AND 

by the key "parentOrgNode". If OrgNode contained a Busi- Agent equals diskagent 

ness Unit, and you wished to assign it to the value of its (Node-"mybox") OR (Node-"yourbox")— evaluates to 

parent ("bubble up"), you may say: TRUE if Node equals mybox or yourbox 

OrgNode=OrgNode.parentorgNode; You can also make use of functions in evaluation expres- 

Another such special member of OrgNode is "name". 50 sions. To test if the fourth word of the Summary field is 

OrgNode.name will return the name of the OrgNode as a "down", use the following: 

string. An example of this would be: extract (Summary, 3)= u down" 

EventContaincrJournalEntryo"Escalated to business The LIKE Operator: The LIKE operator uses a regular 

uoit:"+ OrgNode. name; expression to match a particular value. The regex may be 

55 any valid Perl 5 flavor regex. For more information, see the 

Arrays p e rl 5 manual. To test if the Node field ends with "com", use 

In addition to referencing members of a variable, you may ihc Allowing expression: 

reference array indicies. For example, to set a variable Node LIKE < .*com' 

equals to an array of strings, you may do the following: 6Q jf statement 

Types-C'Rota", "User", "Business Unit"); ycm cafl ^ thc ff (Qr as follows: 

You can also create arrays of other variables: . r /Kr AX fc 40 . . c iir KT 

_ . t , _ _ v if (Num>0) { Even tContamer.Summary- "Found +Num+ 

Names«(EventContamerNode, EventContainer.Agent); "objects "■) 
To reference an element in an array, you simply use the 

following notation: 65 REL Function Reference 

Type=Types [0]; — Assigns the zero'th element of Types REL supports functions that can perform specialized 

to the type variable. operations. 
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Eval() 



34 



Eval(<expression>, <context>) will evaluate <expres- 
sion> using variables pulled from <context>. 
Example; 

Context-NewObject ( ); 
Gontext.Node. 'wombat'; 
Context. Agent-'disk'; 

Message =eval(* "The machine" +Node+"had a problem 

from"+Agent*, Context); 
Message would be equal to: 
The machine wombat had a problem from disk 

extract ( ) 

extracl(<long string>, <index starting from 0>, [<word 
delimeter>D <long string> is the entire string to extract 
from. <index starting from 0> is the word index. <word 
detimeter> is an optional field which specifies the word 
boundary (space is the default). 

extract ( ) allows you to extract a specific word from a 
longer string. 
Example: 

To extract the 2nd word from the Summary field in an ^ 
event, you might use the following assignment expression: 
AffectedNode=extract(EventContainer.Summary, 1); 

float ( ) 

float(<int>\<string>\<float>) returns a float representation 30 
of its argument. 



variable that is currently not an Integer. Example: (assume 
OrgNode is pulled from an external SQL database which has 
a column called Severity which is an Integer): 
NewSeverity="5"; 
5 OrgNode. Severity=int (NewSeverity); 

Failing to use int ( ) in this case would have caused an 
error. 
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localtime ( ) 

localtime(<seconds__since_epoch>, [<pattern>]) 35 

This is used to format an integer containing the number of 
seconds since the epoch into a string using an optional 
specified pattern. 
Example Patterns: 

"MM/dd/yyyy HH:mm:ss zz" 4 ° 

"EEE, MMM dd, yyyy h:mm a zzzz" 

To obtain <seconds_since_epoch>, you can use getdate( 
). Therefore, to get the current formatted time, use localtime 
(getdate( )). 
Example: 

t«localtime(getdate( )); 

t will have a value similar to: 06/05/1997 09:56:22 EDT 
Example: 

tolocal time(getdate ( ), "EEE, MMM dd, yyyy h: mm a 50 
zzzz"); 

t will have a value similar to: Fri, Jun 05, 1997 9:58 AM 
Eastern Daylight Time 

This function is useful when you are trying to insert a date 
into a SQL based database which requires dates to be 55 
inserting in a particular format. 

getdate( ) 

getdate( ) returns the current time in seconds since mid- 60 
night GMT on January 1, 1970. 

int() 

int(<float>|<stringxboolean>|<int>) returns an integer 

representation of its argument. 65 
It is necessary to use into when updating a field in a 
database that you know to be of an Integer type with a 



length ( ) 

length(<array>) returns the length of its array argument. 
log() 

log(<expression>) records the value of <expression> 
using the ActionTreeLogger service. This is very useful 
for debugging Action Trees as it allows you to inspect 
expressions from the context. 

NewEvent( ) 

This is used in conjunction with a ReturaEvent action 
module-based action node when it is desired to insert a new 
event into the ObjectServer. To cause RetumEvent to insert 
a new event, assign a Newevent ( ) to the EventContainer 
variable. 

EventContainer-NewEvent( ); 

Event Container.Node-" abc"; 

EventContainer. LastOccurrence=getdate( ); 

EventContainer.Identifier=EventContainer.Node+"is 
down"; 

When using NewEvent( ) in conjunction with 
RetumEvent, it is important to note that there are no default 
fields set, as there are when using a probe. It is necessary to 
set all required fields in the event. This is why we must set 
LastOccurrence and Identifier explicitly. 



NewObject() 

NewObject( ) creates a new object which can be used as 
a context to store other variables in. 
Example: 

Context«NewObject( ); 
The following three examples are all equivalent: 

Context. Node-' abc'; 

OR 

Context["Node"]- < abc'; 
OR 

VarName="Node"; 
Context( VarName)- ' abc'; 

This last example shows how to store variables is a 
context when the actual variable is stored in a variable. 
Assigning values in a context is similar in concept to the 
notion of associative arrays in perl. 

random( ) 

random(<upper_bound>) returns a random integer in the 
range [0, <upper_bound]. 

rextract( ) 

rextract(<input_string>, <pattern_string>) 
rextract( ) extracts the indicated substring matched by the 
Perl 5 style regular expression designated by <pattern_ 
string>. You must enclose the segment you wish to 
extract in parentheses. 
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Example: 
so 'there are 5 nodes down"; 
n=rextract(s, "there are (\d+) nodes down"); 
n will have the value 5. 

rextractall ( ) 

rextractall(<input_string>, <pattern_string>) 
rextract( ) extracts all indicated substrings matched by the 
Perl 5 style regular expression designated by <pattern_ 
string>. You must enclose the segments you wish to 
extract in parentheses. 
Example: 

s-"there are 5 nodes down and 12 disk crashes"; 
a-rextractall(s, "there are (\d+) nodes down and (\d.) 

(\w+) crashes"); 
a will have the value (5, 12, '"disk") 

split () 

split(<input_string>, [<delimiters>]) returns an array of 
substrings of <input_string> obtained by splitting up 
<input_string> at the characters contained in the string 
<delimiters> (the delimiting characters are not con- 
tained in the resulting substrings). 

If <delimiters> is omitted, the input string is split up at the 
whitespace characters \n (newline), V (carriage 
returns), and \t (tab). 
Example: 

s="there are 5 nodes down/up"; 

arr=split (s, "\"); 

arr willl have the value: (there, are, 5, nodes, down, up) 
string ( ) 

string(<float>|<int>|<boolean>|<string>) returns a string 

representation of its argument. 
This is necessary to use when updating a field in a 
database that you know to be of a string type with a variable 
that is currently not a string. Example: (assume OrgNode is 
pulled from an external SQL database which has a column 
called AlertKey which is a string): 

NewAlertKey-55; — AlertKey is now an Integer 
OrgNode. Alertxey«string(NewAlertKey); 

strip ( ) 

strip(<input_string>, <string_of_characters_to_ 
strip>) returns the string obtained by stripping from 
<input_string> all occurrences in <input_string> of 
the characters in <string_of_characters__to_strip>. 
Example: 

s^'john's house is on fire!"; 

s2ostrip(s, '"!"); 

s2 will have the value: "johns house is on fire" 
toLower ( ) 

toLower(<string>) returns the string obtained by convert- 
ing <string> to lowercase. 

toUpper ( ) 

toUpper(<string>) returns the string obtained by convert- 
ing <string> to uppercase. 
For a complete list of all functions, click on the "Func- 
tions" button in the Policy Editor. 



36 



10 



15 



20 



25 



30 



35 



40 



45 



50 



55 



60 



65 



What is claimed is: 

1. A software system residing on a computer connected to 
a network in an enterprise, the system being used in ana- 
lyzing the impact of network events on the network, the 
system comprising: 

a plurality of data source adapters for interfacing with 
external data sources to thereby allow access by the 
system to enterprise-related data in the external data 
sources; 

an impact analysis data structure populated with data 
accessed from the external data sources and defining 
relationships between the enterprise-related data; 

an action tree data structure comprising a routine which, 
when executed, acts upon the relationships defined by 
the impact analysis data structure to handle events; and 

a message processor to read the network events and select 
one of the action tree data structures to handle each read 
network event. 

2. The system of claim 1, wherein the impact analysis data 
structure comprises: 

a plurality of organizational nodes each representative of 
an enterprise element and populated with data accessed 
by the system through the use of the data source 
adapters; and 

one or more hierarchy structures of said organizational 
nodes, said hierarchy structures defining relationships 
of organizational nodes to one another by the data 
contained therein, said hierarchy structures representa- 
tive of structures and business processes of the enter- 
prise, 

3. The system of claim 1, comprising an event handler to 
receive and queue data regarding network events from an 
event server. 

4. The system of claim 1, wherein the external data 
sources store data using a plurality of different formats, and 
wherein the data source adapters comprise a data source 
adapter corresponding to each data source format. 

5. The system of claim 4, comprising a selection routine 
for selecting one of the data source adapters corresponding 
to a given external data source. 

6. The system of claim 4, wherein each data source 
adapter resides on a single computer with the corresponding 
external data source. 

7. The system of claim 1, comprising a plurality of 
message processors utilized to read a plurality of events in 
parallel. 

8. The system of claim 1, comprising a state database for 
storing a processing state during execution of an action tree 
data structure routine. 

9. A method for analyzing the impact of network events 
on a network in an enterprise, the method comprising: 

collecting and normalizing enterprise data from a plurality 
of individually managed data sources located through- 
out the network; 

populating enterprise data objects representative of enter- 
prise elements using the collected data; 

generating hierarchies of related enterprise data objects 
representative of structures and business processes of 
the enterprise; 

storing a plurality of action objects utilizing stored logic 

to act upon the relationships defined by the hierarchies 

to handle network event; and 
processing received data regarding network events to 

select an action object to execute for each network 

event. 
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10. The method of claim 9, wherein the step of collecting 
and normalizing enterprise data is executed on each com- 
puter upon which an individually managed data source 
resides. 

U. The method of claim 9, comprising queuing received 
network event data for processing. 

12. The method of claim 11, wherein the step of process- 
ing network event data is executed multiple times in parallel. 

13. A method for generating an impact analysis data 
structure for use in handling network events generated by a 
network in an enterprise, the method comprising: 

storing a plurality of data source adapters each capable of 

collecting enterprise-related data from a data source 

having a particular format; 
for each data source, using one of the data source adapters 

to collect enterprise-related data from the data source 

and storing the enterprise-related data in an enterprise 

data object; and 
defining relationships between enterprise data objects of 

different data types representative of structure and 

business processes of the enterprise; 
thereby generating an impact analysis data structure 

which defines relationships between enterprise-related 

data and which is used to determine how a network 

event impacts on the enterprise. 

14. The method of claim 13, comprising a user selecting 
a first data source and automatically selecting a correspond- 
ing data source adapter to use in collecting enterprise-related 
data. 

15. The method of claim 13, wherein the enterprise data 
objects comprise objects or different data types including an 
administrator data object, a workstation data object, and a 
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business unit data object, and wherein the step of defining 
relationships comprising defining relationships between two 
or more enterprise data objects of different data types. 

16. The method of claim 15, wherein the step of defining 
relationships comprises defining a relationship between an 
administrator data object and a workstation data object. 

17. The method of claim 15, wherein the step of defining 
relationships comprises defining a relationship between a 
workstation data object and a business unit data object. 

18. The method of claim 13, wherein the step of defining 
relationships comprises using the data source adapters to 
collect relationship data from the data sources. 

19. A method for using an impact analysis data structure 
to handle network events generated in a network in an 
enterprise, the method comprising: 

populating the impact analysis data structure with data 
accessed from a plurality of data sources throughout the 
network; 

defining, by the impact analysis data structure, relation- 
ships between enterprise -related data objects including 
administrators, workstations, or business units; 

selecting an action policy to implement for a given 
network event; 

identifying a workstation affected by the given network 
event; 

traversing the impact analysis data structure to determine 
the one or . more administrators, and one or more 
business units affected by the network event; and 

using the action policy to contact the one or more affected 
administrators. 
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